Wallet-drain losses tied to reseller Ledger devices neared $90M; Ledger halted the seller

On October 9, 2026, on-chain analysts reported a wave of wallet-draining attacks hitting Ledger hardware-wallet users. Specter traced more than $86 million in inflows from hundreds of victim wallets across Ethereum, TRON and Bitcoin, and MistTrack put reported losses approaching $90 million, saying Tether had frozen significant USDT at linked addresses.

The affected customers were reported to be in Southeast Asia and had bought their devices through reseller CryptoBilis. Ledger said it was investigating and asked CryptoBilis to suspend all sales and shipments of Ledger devices while the investigation was underway.

The cause was not confirmed. Former Mt. Gox CEO Mark Karpelès, who days earlier had warned about suspicious sellers, said the case might match tampered devices containing a surveillance implant with a SIM card, and asked affected users to photograph their circuit boards — a connection he explicitly left unconfirmed. Binance founder Changpeng Zhao said the losses 'seem' localized to a supply-chain attack with one vendor, possibly counterfeit or compromised devices, and urged the industry to help trace the funds.

Reported user losses approached $90 million across chains, per MistTrack; Tether froze linked USDT. No confirmed cause, fine or repayment plan had been announced.

The losses concentrated on one reseller channel, pointing to devices whose provenance buyers had no way to verify.

Ledger's response — asking the reseller to suspend sales — came only after analysts had publicly traced millions in losses.

A hardware wallet's entire value proposition is key security; a tampering claim, even unconfirmed, attacks the core promise of the product.

The multi-chain spread of victim wallets meant no single chain's safeguards could contain the damage.

A security brand is only as tamper-proof as its worst reseller. When devices pass through third parties, buyers cannot verify provenance — and a poisoned channel has to be cut off publicly and fast.

The investigation was open, with no confirmed finding on how devices were compromised, whether CryptoBilis units were counterfeit or tampered in transit, or any compensation plan. Tether's freezes were expected to contain some of the stolen USDT, and Karpelès was collecting photos of affected circuit boards to test the implant theory.