Ledger CryptoBilis Hack Drains $92.9M, 311 Wallets [2026]

A crypto hardware wallet is supposed to be the one device nobody can touch remotely. On October 9, 2026, that assumption broke for hundreds of people in Southeast Asia. Ledger, the French hardware wallet maker, confirmed it is investigating asset losses tied to devices sold through CryptoBilis, an authorized reseller in Indonesia, Malaysia, and the Philippines. By the next morning, on-chain investigators at Bitquery had traced $92.9 million drained from 311 wallets across five blockchains, a figure that kept climbing as researchers found addresses the first public lists missed.

The attack matters beyond the dollar figure. Hardware wallets exist to keep a 24-word recovery phrase away from the internet entirely, the one piece of information that lets anyone rebuild a wallet and spend its coins. This incident suggests someone captured that phrase before the owner ever touched a keyboard, through the supply chain itself rather than a phishing email or a malicious browser extension. That is a harder problem to defend against, and it is why this case is already drawing comparisons to the Coldcard wallet theft traced earlier this year.

The headline numbers behind the Ledger CryptoBilis hack