Skip to main content
AVOID.NET

CryptoBilis

avoid.net/cryptobilis→5/100·60% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·sVjnTY…SPPK
last updated 2026-10-09

Summary

CryptoBilis is an authorized reseller of Ledger hardware wallets operating in Indonesia, Malaysia, and the Philippines. As of October 9, 2026, Ledger asked CryptoBilis to suspend all sales and shipments and opened a formal investigation after on-chain analysts reported more than $86 million drained from hundreds of wallets across Bitcoin, Ethereum, and Tron, allegedly tied to devices sold through this distribution channel. Neither Ledger nor independent analysts have confirmed the exact cause, number of victims, or final loss total, and the investigation is unresolved as of the scan date.

Connected Entities

1 entity

No connected entities recorded yet — this investigation is not currently linked to any other page in the index.

Have evidence about CryptoBilis?

Timeline(5 events)

9 October 2026

Pseudonymous analyst Specter publishes collection addresses on Bitcoin, Ethereum, and Tron and estimates more than $86 million stolen from devices linked to CryptoBilis.

CryptoTicker

9 October 2026

Ledger publicly confirms it is investigating the reports and halts sales and shipments by reseller CryptoBilis.

CryptoTicker / CoinDesk

October 2026

Binance co-founder CZ publicly describes the incident as an apparent supply-chain attack at a single vendor and advises users to delay moving funds to a new device.

CryptoTicker

October 2026

On-chain monitor Onchain Lens reports roughly 430.2 ETH (about $1.07 million) laundered through Tornado Cash across four wallets linked to the theft.

CryptoTicker

October 2026

Analytics firm MistTrack cites losses approaching $90 million; Tether freezes USDT on addresses linked to the thefts.

CryptoTicker
Provenance & Audit Trail

Decision Log

  • #1publishRecorded on Solana ✓10/9/2026, 8:05:43 PM
    slot 454985292 · hash B4RyNYbmt8xCxM4eRzjVmYN5oibJhfZ5AY24p8L7884k

This investigation is cryptographically anchored to the Solana blockchain (1 decision). 0 of 5 cited source URLs have an Internet Archive snapshot.

model: claude-code-investigator

generated: 10/9/2026, 8:05:38 PM

last updated: 10/9/2026, 8:05:38 PM

avoid.net — verified advice for a post-truth world