---
title: Ledger Investigates Suspected $86M Theft Linked to CryptoBilis Reseller
url: >-
  https://www.cryptocatalyst.news/articles/2026-10-11-ledger-investigates-suspected-86m-theft-linked-to-cryptobilis-reseller
canonical: >-
  https://www.cryptocatalyst.news/articles/2026-10-11-ledger-investigates-suspected-86m-theft-linked-to-cryptobilis-reseller
date: '2026-10-11T13:16:20.680408+00:00'
category: web3
tags:
  - ledger
  - cryptobilis
  - wallet-security
  - crypto-theft
source: Decrypt
source_url: 'https://decrypt.co/380582/ledger-probes-87m-theft-crypto-wallet-reseller'
publisher: CryptoCatalyst
summary: >-
  Ledger asked reseller CryptoBilis to pause sales and warned recent buyers not
  to set up their devices amid reports of more than $86 million in thefts.
image: >-
  https://www.cryptocatalyst.news/images/articles/2026-10-11-ledger-investigates-suspected-86m-theft-linked-to-cryptobilis-reseller.webp
generated_by: automated editorial pipeline
---
# Ledger Investigates Suspected $86M Theft Linked to CryptoBilis Reseller

Ledger is investigating suspected thefts of more than $86 million tied to devices sold by reseller CryptoBilis. It asked the reseller to stop sales and told recent buyers not to set up their wallets while the investigation continues.

## Key takeaways

- An onchain investigator tracked more than $86 million in suspected thefts linked to CryptoBilis customers.
- Ledger asked CryptoBilis to pause sales while it investigates.
- Ledger urged recent CryptoBilis buyers not to set up their devices.
- The cause and scope of the suspected thefts have not been established in the provided report.

Ledger is investigating suspected thefts totaling more than $86 million that an onchain investigator linked to customers of crypto wallet reseller CryptoBilis. Ledger asked CryptoBilis to pause sales and urged people who recently bought devices from the reseller not to set them up.

A hardware wallet stores the keys used to access crypto, so a warning about a device’s source is worth taking seriously. Ledger has not established publicly, in the information available here, how the suspected thefts happened or whether every CryptoBilis-sold device is affected.

## What should recent CryptoBilis buyers do?

Follow Ledger’s warning: do not initialize a recently purchased device from CryptoBilis until Ledger provides further guidance. If you have already set one up, avoid entering your recovery phrase into websites, apps, or messages claiming to help; that phrase can give someone control of your funds.

The key distinction is that the reported losses are suspected and tied to onchain tracking, while the cause and scope remain under investigation. The available report does not identify a confirmed technical flaw in Ledger devices generally.

## What makes this case different from a typical wallet hack?

The warning concerns the reseller channel, not simply a vulnerability announced in a wallet’s software. That makes the device’s supply path central: buyers are being told to pause before trusting equipment obtained through CryptoBilis, rather than to assume all Ledger wallets are compromised.

For users, this is a reminder that hardware wallets reduce some online risks but do not remove the need to trust where a device came from. Unlike an exchange breach, where a company may hold customer assets, a wallet incident can put the recovery phrase—and therefore direct control of funds—at issue.

## What should buyers watch for next?

The practical trigger is a clear update from Ledger explaining whether CryptoBilis devices were altered and what affected customers should do. Until then, recent buyers should avoid setting up those devices and should treat unsolicited requests for recovery phrases as dangerous. Ledger’s investigation and any guidance on identifying affected units will determine the next step.

## FAQ

### What happened with Ledger and CryptoBilis?

Ledger is investigating suspected thefts of more than $86 million linked by an onchain investigator to CryptoBilis customers. Ledger asked the reseller to pause sales and warned recent buyers not to set up their devices.

### Should I set up a Ledger device bought from CryptoBilis?

Ledger urged recent CryptoBilis buyers not to set up their devices while the investigation continues. Wait for direct guidance from Ledger before using one.

### Are all Ledger wallets affected?

The report links suspected thefts to a reseller and does not establish that all Ledger devices are affected or identify a confirmed flaw in Ledger wallets generally.

## Source

This article is a summary of reporting by [Decrypt](https://decrypt.co/380582/ledger-probes-87m-theft-crypto-wallet-reseller), written by an automated editorial pipeline. See https://www.cryptocatalyst.news/editorial-policy.

## How to cite

CryptoCatalyst.news, "Ledger Investigates Suspected $86M Theft Linked to CryptoBilis Reseller", 2026-10-11, https://www.cryptocatalyst.news/articles/2026-10-11-ledger-investigates-suspected-86m-theft-linked-to-cryptobilis-reseller