An investigation with unanswered questions

Ledger said on October 9 that it was investigating reports of lost funds among Southeast Asian customers who bought devices through reseller CryptoBilis. The Block reported the company’s statement and its request that the reseller pause sales and shipments while the investigation continued. At that point, the cause of the reported losses had not been established in the statement.

The company issued precautionary guidance for people who bought from that reseller during the previous 90 days, including delaying setup of unused devices and considering a new signer with a new seed for devices already configured. This article covers that initial announcement. Reported on-chain loss estimates should not be confused with a total confirmed by Ledger.

Security includes the journey to the buyer

A hardware wallet is part of a larger process. It is manufactured, transported, sold, delivered and initialized before it protects an account. Each stage raises different questions about authenticity, custody and instructions presented to the customer. Strong cryptographic design addresses only part of that complete journey.

Our analysis is that the reseller inquiry makes distribution controls an important part of the discussion. A buyer needs confidence in the specific device received and in the setup process, as well as in the general reputation of a product. That is why details about which devices and purchases are affected matter more than broad claims about every hardware wallet.

Evidence should lead the conclusion

An investigation can produce changing information. A precautionary sales pause is an action taken under uncertainty, rather than a complete explanation of what happened. Equally, a suspected theft amount may change as researchers identify related addresses or remove duplicate transactions from their counts.

Reporting should therefore keep confirmed company statements, independent estimates and possible explanations separate. Readers should be able to tell which claim is established and which still depends on further analysis. Assigning a cause prematurely could misdirect attention and leave affected customers with an incomplete understanding.

The useful next evidence will concern scope, mechanism and remediation: which purchases are implicated, what investigators find and how the companies communicate concrete steps to affected buyers. For the broader self-custody market, the event highlights the importance of the entire ownership process. A secure transaction-signing device works within a chain of physical and human decisions, and confidence in that chain needs to be supported by evidence as the inquiry develops.

Source: https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163