Cryptoupdated 54m ago2 min read
Ledger Links 87-Million-Dollar Theft To CryptoBilis, Tightens Reseller Supply-Chain Protocols
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Ledger ties the majority of losses to CryptoBilis-sold devices, estimating about $86–$94 million. Ledger temporarily halts CryptoBilis sales and advises customers to refrain from activating affected wallets.
Ledger ties theft to CryptoBilis
Ledger confirmed that all validated cases in the recent incident that led to the theft of approximately 87 million dollars are directly linked to devices distributed by Southeast Asian reseller CryptoBilis. Ledger clarified that its core systems and direct-sales channels have not been breached, and it said preliminary findings point to a break in the external physical distribution chain. Forensic blockchain analysis mapped the flow of stolen assets, and YFarmX security analysts identified an initial list of more than 450 drained wallets affecting Bitcoin (BTC), Ethereum (ETH), and Tron holders.
Ledger also said it is investigating where in the physical custody chain the devices were tampered with, and it began proactively contacting registered users in that region to mitigate impact and provide technical assistance. Ledger tightened its protocols for official distributors and global resellers, and it sent an instruction that categorically prohibits reintegrating into inventory any products returned by previous customers.
Trezor cuts resellers after scare
Trezor said it will cut its third-party reseller program by January 2027 in response to the Ledger supply chain attack. Danny Sanders, Chief Operating Officer (COO) at Trezor, said, "Supply chain security is never finished," and he added that Trezor is raising the bar for partners with closer checks on how devices are sourced, stored, and handled. OneKey founder Yishi Wang announced that OneKey axed 95% of its resellers and paused shipments to all resellers while reviewing its third-party distributors.
Ledger urged resellers in Southeast Asia and Hong Kong to pause hardware wallet sales, and Ledger said it was yet to verify claims that the drain had spread beyond Southeast Asia. Cointelegraph security researcher Joe Grand said it is "really hard to explain to people" how users are supposed to review devices for tampering, because even technical people do not check every single device.
Europe retailer pulls products
Ledger asked sellers in six Southeast Asian countries and Hong Kong to temporarily suspend hardware wallet sales and remove display units from stores while it investigated reported crypto theft losses tied to device tampering. Ledger said there are no signs its infrastructure, systems, services or official direct sales channels were compromised, and it said the probe is focused on tampering during distribution. MediaMarktSaturn pulled all Ledger products from its stores and online platforms, and the company said it was in contact with the manufacturer as tampering reports spread beyond Southeast Asia.
A European buyer claimed that two Ledger Nano X wallets purchased at MediaMarkt stores came with extra cables and a hidden LTE module, and Ledger said it had not confirmed those claims. Ledger wrote on X that "To date, all confirmed cases related to the October 9, 2026 incident involve devices sold by Southeast Asian reseller CryptoBilis," and it added that the volume of affected devices is "limited."