Bitcoin Holder Loses $5.2 Million in BTC After Ledger Hack

Millions in Crypto Vanish After Users Purchase Compromised Ledger Devices from Reseller

A cryptocurrency holder has reported the loss of 80 Bitcoin, valued at approximately $5.2 million, after transferring the digital assets to a Ledger hardware wallet. The device in question was not purchased directly from Ledger, the manufacturer, but rather from CryptoBilis, a reseller operating in Southeast Asia. The transfer to the new hardware wallet occurred just one week prior to the funds disappearing.

This significant Bitcoin loss is not an isolated incident. A number of other buyers who acquired Ledger devices through the same reseller have also come forward with reports of substantial financial losses.

Ledger confirmed on October 9, 2026, that it has launched an investigation into fund losses linked to CryptoBilis. The company has opted to issue guidance to affected customers without waiting for the full investigation to conclude.

Customers who purchased a Ledger device from CryptoBilis within the last 90 days have been strongly advised not to initialize their new devices. Ledger is further recommending that these buyers transfer their existing assets to newly set-up Ledger wallets, utilizing different seed phrases to ensure security.

Another victim has reported losing 7 million USDT, a stablecoin pegged to the U.S. dollar. This user had acquired their Ledger device three weeks before the incident.

On-chain analysts have been tracking the flow of stolen assets across multiple blockchain networks, identifying funds directed to known theft addresses. These trackers have flagged approximately $17.7 million in Bitcoin and an equivalent of $29 million in Ethereum currently held in wallets associated with these thefts.

Estimates from analysts suggest the total financial damage could range from $72 million to over $87 million, distributed across a multitude of victim wallets.

The precise cause of these losses remains unconfirmed. However, speculation is currently focused on two primary possibilities: supply-chain tampering, where a device is compromised before it reaches the end-user, or sophisticated phishing attacks designed to trick users into divulging sensitive information.

To date, there have been no reports indicating that Ledger devices purchased through official, direct channels have been affected. This suggests the issue is localized and specifically tied to the reseller, CryptoBilis. The reseller’s operational reach extends across Southeast Asian markets, including Indonesia, Malaysia, and the Philippines.

If supply-chain tampering is identified as the root cause, it would highlight a critical vulnerability in the security model, particularly if hardware can be compromised prior to delivery. Conversely, if phishing attacks are found to be responsible, the focus would shift to user behavior and the methods employed to target victims.

For now, the recommended course of action for affected individuals is clear. Anyone who purchased a Ledger device from CryptoBilis within the past 90 days is urged to adhere to Ledger’s guidance: do not initialize the device and promptly move any existing funds to a new Ledger wallet secured with a different seed phrase.

Ledger’s ongoing investigation will be crucial in determining the exact sequence of events, whether the reseller was complicit in the scheme or a victim itself, and if the extent of the financial damage surpasses current estimates.