---
title: Ledger investigates potential wallet tampering after $86M in crypto stolen
url: >-
  https://www.cryptocatalyst.news/articles/2026-10-10-ledger-investigates-potential-wallet-tampering-after-86m-in-crypto-stolen
canonical: >-
  https://www.cryptocatalyst.news/articles/2026-10-10-ledger-investigates-potential-wallet-tampering-after-86m-in-crypto-stolen
date: '2026-10-10T13:05:34.464795+00:00'
category: web3
tags:
  - ledger
  - hardware-wallet
  - crypto-theft
  - security
  - southeast-asia
source: CoinDesk
source_url: >-
  https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen
sources:
  - name: CoinDesk
    url: >-
      https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen
  - name: CoinTelegraph
    url: >-
      https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound
  - name: The Block
    url: >-
      https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163
publisher: CryptoCatalyst
summary: >-
  Ledger probes CryptoBilis reseller after reports of $86M in crypto thefts from
  Bitcoin, Ethereum, and Tron wallets. Users urged to check devices for
  tampering.
image: >-
  https://www.cryptocatalyst.news/images/articles/2026-10-10-ledger-investigates-potential-wallet-tampering-after-86m-in-crypto-stolen.webp
generated_by: automated editorial pipeline
---
# Ledger investigates potential wallet tampering after $86M in crypto stolen

Ledger is investigating hardware wallets sold by a Southeast Asian reseller after reports of $86 million in crypto thefts. Users are advised to check their devices for tampering.

## Key takeaways

- Ledger is investigating CryptoBilis after reports of $86M in crypto thefts.
- Bitcoin, Ethereum, and Tron addresses were drained in the suspected tampering.
- Users who bought from CryptoBilis should verify device authenticity immediately.

Ledger, a leading hardware wallet maker, is investigating potential tampering of its devices sold by a Southeast Asian reseller after reports of $86 million in crypto stolen from Bitcoin, Ethereum, and Tron addresses. The company has warned users to check their devices for signs of tampering.

## What happened?
Ledger is probing reports of fund losses linked to reseller CryptoBilis. Researchers estimate that more than $72 million to $86 million in suspected crypto thefts have occurred. The company has advised users to verify the authenticity of their devices and follow security best practices.

## What should users do?
Users who purchased Ledger devices from CryptoBilis are urged to check their wallets for any signs of tampering. Ledger has provided a guide on how to verify the authenticity of their devices. Users should also enable two-factor authentication and keep their firmware up to date.

## Why does this matter?
This incident highlights the importance of purchasing hardware wallets from official sources. It also underscores the need for users to regularly check their devices for any signs of tampering. This is not the first time hardware wallets have been targeted, but the scale of the losses in this case is significant. For context, earlier this year, a similar attack on Bitcoin cold wallets resulted in losses of $89 million, as reported in our article on the [Bitcoin cold wallet attack](/articles/2026-08-01-bitcoin-cold-wallet-attack-expands-to-4500-addresses-losses-top-89m).

## FAQ

### What should I do if I bought a Ledger wallet from CryptoBilis?

Check your device for signs of tampering and follow Ledger's guide to verify its authenticity. Enable two-factor authentication and keep your firmware up to date.

### How can I tell if my Ledger wallet has been tampered with?

Ledger provides a guide on its website to help users verify the authenticity of their devices. Look for any unusual signs or discrepancies.

### What cryptocurrencies are affected by this incident?

Reports indicate that Bitcoin, Ethereum, and Tron addresses have been affected by the suspected crypto thefts.

## Sources

This article synthesizes reporting from [CoinDesk](https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen), [CoinTelegraph](https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound), [The Block](https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163), written by an automated editorial pipeline. See https://www.cryptocatalyst.news/editorial-policy.

## How to cite

CryptoCatalyst.news, "Ledger investigates potential wallet tampering after $86M in crypto stolen", 2026-10-10, https://www.cryptocatalyst.news/articles/2026-10-10-ledger-investigates-potential-wallet-tampering-after-86m-in-crypto-stolen