A Bitcoin holder lost 80 BTC, worth $5.2 million, one week after transferring the coins to a Ledger hardware wallet purchased from Southeast Asian reseller CryptoBilis. Ledger confirmed on October 9, 2026 that it is investigating a string of fund losses connected to the reseller, with on-chain analysts estimating total damage between $72 million and more than $87 million.

The 80 BTC case fits a broader pattern. Multiple buyers who acquired Ledger devices through the same reseller have reported significant losses. Another victim lost 7 million USDT after buying a Ledger device three weeks before the incident.

What has Ledger told customers?

The company is not waiting for its investigation to conclude before issuing guidance. Buyers who purchased a Ledger from CryptoBilis within the last 90 days should:

• Not initialize the device.
• Move their assets to a new Ledger wallet set up with a different seed phrase.

So far, no reports indicate that Ledger devices bought through official channels have been affected, which points toward a localized issue tied to the reseller rather than a flaw in Ledger's products. CryptoBilis operates across Southeast Asian markets including Indonesia, Malaysia and the Philippines.

What do on-chain records show?

Analysts have traced assets flowing to theft addresses across several blockchain networks. Trackers have identified:

• $17.7 million in BTC held in wallets linked to the thefts.
• $29 million worth of ETH equivalents sitting in the same cluster of addresses.

Estimates of total damage range from $72 million to more than $87 million, spread across numerous victim wallets.

Is it supply-chain tampering or phishing?

The cause remains unconfirmed. Speculation centers on two possibilities.

The first is supply-chain tampering, where a device is compromised before it reaches the buyer. If that proves correct, the hardware wallet security model breaks at its weakest link: whoever handles the device first controls the trust chain, and a customer following every official setup instruction would still be exposed.

The second is phishing, where attackers trick users into handing over sensitive information. Under that scenario, the takeaway shifts from device integrity to user behavior and how victims were targeted after purchase.

What happens next?

Ledger's investigation must answer three questions: what actually happened, whether the reseller was complicit or itself a victim, and whether the damage extends beyond the current estimates. Until the company publishes its findings, the 90-day advisory stands as the operative guidance, and the roughly $47 million already located in theft-linked wallets gives investigators a concrete trail to follow.