Ledger tells CryptoBilis buyers to stop using tampered wallets after $86 million to $93 million drain

Ledger has a blunt message for anyone who bought a hardware wallet from CryptoBilis recently: do not trust that device. If it is still in the box, leave it uninitialized. If you already set it up, move your assets to a new Ledger with a brand-new recovery phrase. The guidance follows on-chain investigations that estimate losses ranging from $86 million to $93 million, spread across hundreds of wallets. What Ledger found inside the box On October 9, 2026, Ledger ordered CryptoBilis, its Southeast Asian reseller, to stop all sales and shipments. The move came after reports that wallets bought through the distributor were being drained. A day later, on October 10, Ledger confirmed that at least one affected device contained an unauthorized hardware implant. According to the company, every verified draining case traced back to a CryptoBilis purchase. The implant was an LTE-enabled microcontroller with eSIM functionality. It could capture a user’s recovery phrase during wallet setup, without compromising the device’s secure element. The affected wallets spanned multiple networks, including Bitcoin, Ethereum, and TRON. The reseller problem CryptoBilis operates in Indonesia, Malaysia, and...