Security alert · Oct 9, 2026: Ledger devices bought from a reseller in Southeast Asia were drained. Buy hardware wallets only from the maker. What to do →

Multisig Setup

Checklist

Ledger reseller attack, Oct 2026: what to do

Last reviewed: October 2026

TL;DR

On October 9, 2026, Ledger said it is investigating loss of funds by users in Southeast Asia who bought Ledger devices from a reseller called CryptoBilis. Ledger asked the reseller to pause all sales. The cause isn’t confirmed yet, but it looks like a supply chain attack: devices that were tampered with before they reached the buyer.

What this site now says: buy a hardware wallet only from the maker’s own shop or from Amazon.com itself, never from a reseller.

What Ledger said

Ledger’s support account posted this on October 9, 2026:

“Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed).”

The statement is about devices bought from this one reseller. It doesn’t say anything about devices bought directly from Ledger.

What isn’t confirmed

  • The cause. Ledger hasn’t said how the funds were taken. A supply chain attack is the explanation most reports point to, but it isn’t confirmed.
  • The amount. On-chain investigators estimated losses of more than $72 million and later more than $86 million. Ledger hasn’t confirmed any figure.
  • Hidden hardware. Mark Karpelès, former CEO of Mt. Gox, said a Ledger Nano X he received from Malaysia had intact shrink-wrap but contained a hidden module. Ledger hasn’t confirmed that, or any link to these losses.

Why a reseller is the weak spot

A hardware wallet is only as trustworthy as the path it took to reach you. Once a device leaves the maker, anyone who handles it can open it, add hardware or swap it for a fake, and reseal the box. An official reseller listing doesn’t stop that. Intact packaging and a passed authenticity check make a problem less likely, but they can’t prove that nothing was added inside. That’s the supply chain attack described in supply chain attacks on hardware wallets.

So the rule on this site is now simple: buy directly from the maker’s own shop, or from Amazon.com when the listing says “Ships from and sold by Amazon.com”. Not from a reseller, not second-hand, not from a third-party seller on a marketplace. Always do the tamper check when the device arrives.

What to do

  1. Bought a Ledger from CryptoBilis in the last 90 days and not set it up yet? Don’t set it up. Contact Ledger only through support.ledger.com.
  2. Already set it up? Treat that seed as known to others. In a 2-of-3 multisig one exposed key isn’t enough to spend, so you have time to do this calmly, but do it: create a new key on a device bought directly from the maker, build a new wallet with it (steps 6 to 10) and move all funds. Moving to a new multisig explains the steps.
  3. Any device in your setup came from a reseller? My advice is the same: replace that key with one from a device bought directly from the maker.

Never type your seed words into a website or app, and ignore anyone who contacts you about this incident and asks for them. That’s always a scam.

Sources