{"investigation":{"slug":"cryptobilis","entity_name":"CryptoBilis","trust_score":5,"severity_base":null,"score_modifier":0,"confidence":0.6,"status":"published","content_type":"investigation","summary":"CryptoBilis is an authorized reseller of Ledger hardware wallets operating in Indonesia, Malaysia, and the Philippines. As of October 9, 2026, Ledger asked CryptoBilis to suspend all sales and shipments and opened a formal investigation after on-chain analysts reported more than $86 million drained from hundreds of wallets across Bitcoin, Ethereum, and Tron, allegedly tied to devices sold through this distribution channel. Neither Ledger nor independent analysts have confirmed the exact cause, number of victims, or final loss total, and the investigation is unresolved as of the scan date.","sections":[{"content":"CryptoBilis is listed on Ledger's official reseller directory as an authorized dealer, operating under the domains cryptobilis.id and cryptobilis.com. Reporting from Finance Magnates (via Coinspectator) and CryptoTicker describes CryptoBilis as a Southeast Asia-focused reseller selling Ledger hardware wallets to customers in Indonesia, Malaysia, and the Philippines. Prior to October 2026, there is no indication in available reporting that CryptoBilis had been the subject of prior complaints or regulatory scrutiny.","heading":"Background: Role as a Ledger Reseller","sources":[{"url":"https://www.ledger.com/reseller","name":"Ledger official reseller directory","type":"official","credibility":1},{"url":"https://coinspectator.com/mainstream/2026/10/09/ledger-probes-reseller-supply-chain-as-analysts-track-86-million-in-suspected-drains/","name":"Ledger Probes Reseller Supply Chain as Analysts Track $86 Million in Suspected Drains","type":"news_article","credibility":2}],"severity":"low"},{"content":"On October 9, 2026, pseudonymous on-chain investigator Specter (@SpecterAnalyst) published a set of addresses allegedly used to collect stolen funds, estimating that more than $86 million had been drained from hundreds of wallets. Specter later said the exact number of affected wallets had not been established. A separate analyst, tanuki42, put losses above $72 million, while analytics firm MistTrack later cited a figure approaching $90 million. CoinDesk reported that losses were traced across Bitcoin, Ethereum, and Tron addresses, and Crypto Briefing reported that one Bitcoin address alone, bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl, had reportedly received over 211 BTC that had not moved as of publication. Blockchain intelligence firm Arkham reportedly labeled the collection addresses \"Ledger Theft.\" None of these figures have been independently confirmed by Ledger, and Coinspectator's reporting notes that not every transaction included in the estimate has been proven to involve an actual CryptoBilis customer.","heading":"Alleged $86-90 Million Multi-Chain Theft","sources":[{"url":"https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen","name":"Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen","type":"news_article","credibility":1},{"url":"https://cryptobriefing.com/ledger-users-drained-86-million-exploit/","name":"Ledger users reportedly drained of over $86 million in suspected exploit","type":"news_article","credibility":2},{"url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","name":"Ledger Hack: $86M Drained, Reseller CryptoBilis Halted","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Ledger issued a public statement, posted via Ledger Support on X on October 9, 2026, saying it was investigating reports of stolen funds linked to devices sold through a reseller in Southeast Asia. Ledger asked CryptoBilis to pause all sales and shipments pending the outcome of the investigation. Ledger advised customers who purchased devices from CryptoBilis within the prior 90 days not to initialize them, and advised customers who had already set up a device to transfer their assets to a new Ledger device generated with a new seed phrase. Ledger stated it had not confirmed the $86 million loss figure or identified the cause, and said there was no confirmed evidence that Ledger's own hardware, firmware, or Ledger Live software had been compromised; the suspected issue was isolated to the CryptoBilis distribution channel.","heading":"Ledger's Response: Suspension and Investigation","sources":[{"url":"https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen","name":"Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen","type":"news_article","credibility":1},{"url":"https://coinspectator.com/mainstream/2026/10/09/ledger-probes-reseller-supply-chain-as-analysts-track-86-million-in-suspected-drains/","name":"Ledger Probes Reseller Supply Chain as Analysts Track $86 Million in Suspected Drains","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The precise attack vector is unconfirmed. CryptoTicker reported that Mark Karpelès, former head of Mt. Gox, examined a device he said was purchased on a third-party marketplace at a discount and shipped from Malaysia, and described finding a hidden chip inside the casing capable of reading the device's screen, recording the seed phrase during setup, and transmitting it to an attacker. Karpelès said such a tampered device could still pass Ledger's genuine-device check and would only be detectable by physically opening the unit. Ledger has not confirmed this account or the existence of such an implant. If accurate, the mechanism described would constitute a hardware supply-chain attack rather than a flaw in Ledger's core technology, consistent with Ledger's statement that the issue was isolated to the CryptoBilis channel.","heading":"Alleged Attack Vector: Tampered Devices","sources":[{"url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","name":"Ledger Hack: $86M Drained, Reseller CryptoBilis Halted","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Reporting indicates the drains spanned Bitcoin, Ethereum, and Tron, which analysts cited as evidence of a coordinated campaign rather than a single-chain protocol bug. Analytics firm MistTrack reported that Tether froze USDT on addresses linked to the thefts, while on-chain monitor Onchain Lens reported that roughly 430.2 ETH (about $1.07 million) had been sent to the Tornado Cash mixer across four wallets, and that the attacker was also reportedly swapping frozen-susceptible USDT into USDD, a stablecoin Tether cannot freeze, to evade asset-freezing efforts.","heading":"Multi-Chain Scope and On-Chain Laundering","sources":[{"url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","name":"Ledger Hack: $86M Drained, Reseller CryptoBilis Halted","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen","name":"Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen","type":"news_article","credibility":1}],"severity":"high"},{"content":"According to CryptoTicker, Binance co-founder Changpeng Zhao (CZ) stated publicly that the incident appeared to be a supply-chain attack concentrated at a single vendor, and advised Ledger users to wait before moving significant funds to a replacement device. This claim is reported by a single Tier 2 source and has not been independently corroborated in the other articles reviewed; it should be treated as alleged pending further confirmation from CZ's own channels.","heading":"Public Warning from Binance Co-Founder CZ","sources":[{"url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","name":"Ledger Hack: $86M Drained, Reseller CryptoBilis Halted","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Multiple outlets emphasize that the incident has not been confirmed as a hardware supply-chain attack. Coinspectator reported that Ledger had not identified the countries involved, named any victims, or linked the losses to a general device vulnerability, and that it remained unclear whether affected customers received altered hardware, had previously exposed recovery phrases, or lost funds through phishing or malicious transaction approvals. Crypto Briefing cited community speculation about device or firmware flaws, seed phrase compromise, or phishing through fake apps or websites as alternative explanations. Separately, security researcher CyberScrilla warned of a fake Ledger website ranking highly in search results that solicits seed phrases, though no confirmed link between that phishing site and the CryptoBilis-linked losses has been established. Developer 0xQuit suggested some victims may have been affected by ordinary phishing rather than a hardware compromise.","heading":"Alternative Explanations and Unconfirmed Nature of the Incident","sources":[{"url":"https://coinspectator.com/mainstream/2026/10/09/ledger-probes-reseller-supply-chain-as-analysts-track-86-million-in-suspected-drains/","name":"Ledger Probes Reseller Supply Chain as Analysts Track $86 Million in Suspected Drains","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/ledger-users-drained-86-million-exploit/","name":"Ledger users reportedly drained of over $86 million in suspected exploit","type":"news_article","credibility":2},{"url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","name":"Ledger Hack: $86M Drained, Reseller CryptoBilis Halted","type":"news_article","credibility":2}],"severity":"medium"},{"content":"CryptoTicker's reporting places the CryptoBilis-linked losses (reported at roughly $87 million across 98 wallets, averaging about $888,000 per wallet) alongside an earlier 2026 incident involving Coldcard hardware wallets, where a reported seed-generation flaw led to losses exceeding $111 million across approximately 5,200 wallets (some estimates reaching $130 million), averaging roughly $21,000 per wallet. Crypto Briefing separately noted a fake Ledger Live app that appeared on the Apple App Store earlier in 2026, draining about $9.5 million from more than 50 users, and a previously reported flaw affecting the Zilliqa Ledger app. These incidents are cited for context and are not alleged to be directly connected to CryptoBilis.","heading":"Industry Context: Comparison to Other Hardware Wallet Incidents","sources":[{"url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","name":"Ledger Hack: $86M Drained, Reseller CryptoBilis Halted","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/ledger-users-drained-86-million-exploit/","name":"Ledger users reportedly drained of over $86 million in suspected exploit","type":"news_article","credibility":2}],"severity":"low"}],"timeline":[{"date":"2026-10-09","event":"Pseudonymous analyst Specter publishes collection addresses on Bitcoin, Ethereum, and Tron and estimates more than $86 million stolen from devices linked to CryptoBilis.","source":"CryptoTicker","source_url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","date_evidence":"Ledger's statement (13:32 UTC, 9 October 2026, per the article)"},{"date":"2026-10-09","event":"Ledger publicly confirms it is investigating the reports and halts sales and shipments by reseller CryptoBilis.","source":"CryptoTicker / CoinDesk","source_url":"https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen","date_evidence":"Ledger's statement (13:32 UTC, 9 October 2026, per the article)"},{"date":"2026-10","event":"Binance co-founder CZ publicly describes the incident as an apparent supply-chain attack at a single vendor and advises users to delay moving funds to a new device.","source":"CryptoTicker","source_url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","date_original":"2026-10-09"},{"date":"2026-10","event":"On-chain monitor Onchain Lens reports roughly 430.2 ETH (about $1.07 million) laundered through Tornado Cash across four wallets linked to the theft.","source":"CryptoTicker","source_url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","date_original":"2026-10-09"},{"date":"2026-10","event":"Analytics firm MistTrack cites losses approaching $90 million; Tether freezes USDT on addresses linked to the thefts.","source":"CryptoTicker","source_url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","date_original":"2026-10-09"}],"sources_used":[{"url":"https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen","name":"Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen","type":"news_article","archive_url":"http://web.archive.org/web/20261009145024/https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen","credibility":1,"archive_timestamp":"2026-10-09T14:50:24+00:00"},{"url":"https://cryptobriefing.com/ledger-users-drained-86-million-exploit/","name":"Ledger users reportedly drained of over $86 million in suspected exploit","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/","name":"Ledger Hack: $86M Drained, Reseller CryptoBilis Halted","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://coinspectator.com/mainstream/2026/10/09/ledger-probes-reseller-supply-chain-as-analysts-track-86-million-in-suspected-drains/","name":"Ledger Probes Reseller Supply Chain as Analysts Track $86 Million in Suspected Drains","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.ledger.com/reseller","name":"Ledger official reseller directory","type":"official","archive_url":null,"credibility":1,"archive_timestamp":null}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-10-09T20:05:38.30691+00:00","updated_at":"2026-10-09T21:16:47.307816+00:00"},"source_quality":{"total":5,"tier1":0,"tier2":1,"tier3":0,"unrated":4},"follower_count":null,"content_updated_at":"2026-10-09T20:05:38.635Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}