Multiple Users Who Purchased Ledger Hardware Wallets from Dealer CryptoBillis Report Funds Stolen, Losses Approaching $90 Million
Multiple users who purchased Ledger hardware wallets from dealer CryptoBillis have reported stolen funds, with tracked losses approaching $90 million. Ledger's support account has expanded the investigation to Southeast Asia, targeting users who bought devices from this dealer, and has requested the dealer to suspend sales and shipments. The company refers to the dealer as CryptoBillis in one instance and CryptoBilis in another.
Lookonchain detected a single-user transfer. A user identified by the address TY24Ya purchased a Ledger from CryptoBillis three weeks ago, deposited $7 million USDT, and approximately 10 hours ago, all funds were transferred out. The platform claims this could be one of the largest single losses in this incident. MistTrack did not separately confirm the $7 million, and Ledger has not disclosed this address.
The cumulative figures come from different tracking sources. Tanuki42 previously estimated losses exceeding $72 million, while Specter later estimated over $86 million, covering Bitcoin, Ethereum, and Tron. MistTrack traced the related losses to nearly $90 million and stated that Tether is freezing large amounts of USDT in multiple related addresses. Freezing does not automatically refund or cover Bitcoin and Ethereum that have already been transferred out.
The official recommendation remains limited to a 90-day window. Buyers who have not initialized their devices should not set them up; those who have set them up should consider using new recovery phrases to transfer assets to new Ledger signing devices. CryptoBilis is listed as an official dealer in Indonesia, Malaysia, and the Philippines. Decrypt reported that device tampering has not been confirmed. There are no official conclusions regarding the cause, technical path, or identity of the attacker.
Binance co-founder Changpeng Zhao posted on the same day, stating that based on current information, the incident seems limited to one supplier, and a few individuals may have purchased counterfeit or tampered devices. This is his judgment, not Ledger's investigation conclusion.
This is not a transaction but a transfer of user funds through the distribution channel. The buyer is the tracked receiving address, and the seller is the CryptoBillis buyer who has completed setup and deposited assets. The incident is driven by user reports and on-chain monitoring, not market conditions. Beneficiaries are buyers who have not initialized their devices or have migrated assets with new recovery phrases within the 90-day window; the pressured party includes users like TY24Ya who have deposited large amounts of USDT into these channel devices, as the $7 million is only marked by monitoring parties and the company has not confirmed tampering.
Nearly $90 million is a cumulative figure across multiple chains, while $7 million is a single USDT transaction. The two figures cannot be added together or substituted for each other.
Source: Public Information
ABAB AI Insight
Large losses from hardware wallets typically first appear at a single address and then accumulate to a total. After the 2020 Ledger customer database leak, losses were more often attributed to phishing and threats rather than dealer shipments. The report dated October 9, 2026, focuses on CryptoBillis, with lookonchain noting that TY24Ya purchased and deposited $7 million USDT three weeks ago, which was transferred out about 10 hours ago, marking it as possibly the largest single loss. The three-week gap indicates that the device has been set up and received deposits, not that it is unopened inventory.
The $7 million falls under assets that Tether can intervene with. MistTrack states that large amounts of USDT in multiple related addresses are being frozen, with the total tracked approaching $90 million. Specter's $86 million also includes Bitcoin and Ethereum. Freezing can stop USDT still remaining in blacklisted addresses but cannot stop the already transferred $7 million unless the receiving address still holds it and is included in the freeze list. Ledger has not confirmed this address or any tampering.
For comparison, there were counterfeit Ledgers on e-commerce platforms in 2018, and in 2023, the Ledger Connect Kit was replaced leading to connection hijacking. Currently, we are at a stage where a single transaction is identified, but the cause remains unverified. Control lies with the address that has received the $7 million USDT, not with the user who paid for the device three weeks ago.
Essentially, the trust anchor in the supply chain is stuck at the dealer. The official list includes sellers from Indonesia, Malaysia, and the Philippines in the genuine product channel, and users deposit large amounts of stablecoins into devices after receipt. The mechanism is that after setup, the recovery phrase and signing rights are no longer controlled by the manufacturer's logistics. Monitoring can identify TY24Ya but cannot prove the technical reasons for each device based on the cumulative $90 million.
ABAB News · Cognitive Law
Single transactions identified do not confirm the total.
Deposits occur after setup, not before leaving the factory.
Official dealers sell boxes, while users store balances.