Ledger is investigating reports of lost funds from buyers in Southeast Asia. Its advice depends on whether customers have already set up their devices.
Ledger is investigating reports of lost funds from users in Southeast Asia who purchased products from reseller CryptoBilis. In an October 9 statement, Ledger Support said the company had asked CryptoBilis to pause all sales and shipments of Ledger devices as a precaution while the investigation continues.
Warning covers purchases in the past 90 days
Ledger’s security warning covers customers who bought a Ledger device from CryptoBilis in the past 90 days. Ledger told those who have not yet set up their devices not to begin. For customers who have completed setup, it recommended considering a transfer of assets to another Ledger device configured with a new recovery phrase.
Ledger’s wording for customers with an existing setup is “with new seed.” Entering the old recovery phrase into another device would not create the new wallet described in that advice.
Ledger Support’s CryptoBilis warning, October 9, 2026
The post loads from X when you open it.
The statement does not identify affected device models, give a victim count or establish the technical cause of the losses. The request to suspend sales was presented as a precaution during the investigation, rather than its conclusion. Ledger has not announced a confirmed vulnerability affecting all of its devices.
The $86 million figure is an investigator’s estimate
A loss estimate appeared before the company’s statement in an X post by onchain investigator Specter. The researcher said addresses associated with the theft had received funds from hundreds of victim wallets. Specter put the losses traced across Ethereum, TRON and Bitcoin at more than $86 million.
Ledger did not confirm that amount in its own statement. Its announcement also does not establish that every transfer tracked by Specter involved a device bought from CryptoBilis.
The same recovery phrase restores the same accounts
A recovery phrase allows a wallet’s private keys to be recreated. As Ledger’s explanation of wallet recovery describes, entering the same phrase into a new device reproduces the private keys associated with it. Replacing the physical device does not, by itself, replace those keys.
The English-language video published by Ledger Support on March 17, 2022 explains the role of a recovery phrase in accessing accounts. It predates the CryptoBilis investigation and is included as background: someone with the phrase can restore the same accounts on another device.
Ledger’s official support site says its support team will never ask for a customer’s 24-word recovery phrase. Anyone seeking help should keep their recovery phrase private, including when dealing with someone claiming to represent support.
