The CryptoBilis Incident: How Ledger's October Crisis Began

On Oct. 9, 2026, Ledger said it was investigating reports of missing funds from customers in Southeast Asia who had bought devices through CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines. 

Ledger asked CryptoBilis to pause sales and shipments, and advised recent buyers not to set up unused devices.

By Oct. 10, Ledger confirmed that at least one affected user's device contained an unauthorized hardware implant. The following day, Ledger said the volume of impacted devices appeared limited and that all confirmed cases related to the Oct. 9 draining incident involved CryptoBilis-sold devices, with its internal systems and direct sales channels unaffected.

That framing is important, but it does not make the incident small. Researchers traced losses across Bitcoin, Ethereum, Tron, and other chains, and the case quickly became one of the largest hardware-wallet supply-chain incidents ever reported. For owners, the key lesson was not just about one reseller — it was about how much trust is placed in the box before it is ever opened.