Binance Founder Changpeng Zhao Warns Ledger Hardware Wallet Users to Stay Vigilant, Especially Recent Buyers
Binance co-founder Changpeng Zhao issued a warning to Ledger hardware wallet users to stay vigilant, particularly those who have purchased devices recently. He stated that, based on current information, the incident seems to be limited to the supply chain, involving one supplier, and a few individuals may have received counterfeit or tampered Ledgers.
Zhao noted that Ledger is a historically significant and secure hardware wallet brand in the industry, having stood the test of time, but such incidents can still occur. He expressed hope and belief that participants in the BNB ecosystem and the entire industry would assist in tracking and recovering funds. The Block also recorded his additional comment: self-custody comes with extra responsibility. The post referenced an investigation statement from Ledger's support account at 1:32 PM.
Ledger's statement mentioned that they are investigating fund losses for users in Southeast Asia, with relevant purchases made from the distributor CryptoBilis, which was misspelled as CryptoBillis in one instance. Before the investigation results are released, the company has requested the distributor to suspend all sales and shipments. Users who purchased within the last 90 days and have not initialized their devices should not set them up; those who have already set them up should consider transferring their assets to a new Ledger signing device and using a new recovery phrase. CryptoBilis is listed as an official distributor in Indonesia, Malaysia, and the Philippines.
The estimated loss amount is still being assessed. Tanuki42 reported at 12:00 PM that it exceeded $72 million and is still increasing, listing 8 addresses. Specter raised the estimate to over $86 million at 12:24 PM, covering Bitcoin, Ethereum, and Tron, initially mentioning hundreds of wallets but later clarifying that the actual number is unknown, expanding the list to 10 addresses. Decrypt cited Arkham's breakdown of approximately $42 million in Ethereum, $17.6 million in Bitcoin, and $16.5 million in Tether. Ledger has not confirmed the total amount, and Decrypt noted that tampering has not yet been verified.
Zhao's assessment includes two additional steps compared to the official statement. The official statement only mentioned investigating one distributor and suspending sales, while he framed it as a supply chain attack involving counterfeit or tampered devices. Both descriptions point to a single supplier, and neither has disclosed device serial numbers or confirmed lists.
This is not a token trade, but a recovery request. The buyers are the BNB ecosystem and industry tracking parties he named, while the sellers are the funds that have already entered the receiving addresses. The incident was triggered by Ledger's suspension announcement and his retweet. The beneficiaries are buyers who have not initialized their devices or have migrated assets using a new recovery phrase within the last 90 days; the pressured parties are buyers from CryptoBilis who have completed setup, as the $86 million has not been confirmed by the company, and the counterfeit or tampering has not been officially verified.
The post confines the scope to one supplier while placing the recovery responsibility on ecosystem participants. The official channel remains Ledger's support account, not this retweet.
Source: Public Information
ABAB AI Insight
After stepping down as CEO of Binance, Changpeng Zhao continues to define the scope of industry events using his personal account. Following Binance's settlement with the U.S. Department of Justice in 2023 and his own imprisonment, his public actions have increasingly focused on coordinating the BNB ecosystem rather than on exchange operations. On October 9, 2026, he retweeted Ledger's support account, framing the investigation as a supply chain issue involving a single supplier, and specifically called on BNB ecosystem participants to track the funds. The phrase "self-custody comes with extra responsibility" was noted by The Block and is not in Ledger's original text.
Funds have not returned to the distributor's account. Tanuki42 reported over $72 million, Specter expanded to 10 addresses exceeding $86 million, and Arkham broke it down into Ethereum, Bitcoin, and Tether. During Unchained's review, only over $25 million remained in the original addresses, indicating that most has already been transferred out. Zhao's call for recovery effectively links exchanges and on-chain analysis companies into the same tracking chain. Ledger only requested CryptoBilis to suspend sales and has not confirmed tampering or the total amount.
In contrast, after the 2021 Poly Network asset theft, exchanges cooperated to freeze part of the funds; and after the 2025 Bybit hack, only about 3.5% was frozen. Currently, the situation is in a qualitative phase: the official stance is limited to investigation and recommendations for 90-day buyers, while Zhao has already used the terms supply chain attack and counterfeit devices. Control lies with the party holding the receiving address, not with the retweet.
Essentially, the pricing power has shifted from the manufacturer's explanation to public judgment. Ledger sells secure chips and an official distributor list, while users receive third-party boxes. The mechanism involves layered information: the company's announcement only cuts off sales, while the former exchange leader uses the retweet to attribute the cause to a single supplier. Tracking can begin, but confirmation of the list and conclusions about vulnerabilities have yet to emerge.
ABAB News · Cognitive Law
The official statement mentions an investigation, while the retweet states the cause, with a confirmation document missing in between.
Suspending sales cuts off new stock, but cannot recover balances that have already left.
Self-custody places responsibility on the recipient, not on the brand's longevity.