Ledger Probes Reseller After Reports of More Than $86M in Crypto Losses

Ledger is investigating reports of cryptocurrency losses involving customers in Southeast Asia who purchased hardware wallets from a reseller.

In an October 9 post on X, Ledger said it had asked the reseller, referred to as CryptoBillis in the post, to pause all sales and shipments of Ledger devices while the investigation continues. The company also issued precautions for customers who recently purchased devices from the reseller.

At the time of this publication, Ledger has not confirmed how the reported losses occurred or whether the devices themselves were compromised. The Crypto Times has reached out to Ledger and the reseller for comments on the reported losses and the ongoing investigation but has not received any response at the time of publication.

Ledger advises customers to take precautions

Ledger advised customers who purchased devices from the reseller within the previous 90 days and had not yet set them up not to initiate setup. 

Customers who had already configured their devices were advised to consider moving their assets to a new Ledger signer using a new recovery phrase. Ledger directed customers to its support website for guidance. 

Specter estimates losses at more than $86 million

On-chain investigator Specter said they had traced funds to 10 addresses across Bitcoin, Ethereum, and TRON associated with the suspected theft activity.

In an October 9 post on X, Specter said the addresses had received funds from hundreds of wallets, although the exact number of affected wallets remained unknown.

Another on-chain analyst, Tanuki42 (@tanuki42_), urged people whose funds had moved to several of the same addresses to contact security response group SEAL 911. Tanuki42 estimated losses at more than $72 million and rising.

Addresses show about $22.8 million

Arkham Intelligence screenshots of nine addresses listed by Specter showed Bitcoin and Ethereum holdings at the time of capture. The following five addresses had the displayed balances and values shown below.

The five addresses held approximately $22.8 million combined, based on the displayed values. This is below Specter’s $86 million estimate and does not account for funds that may have moved before the screenshots were captured.

The tenth address in Specter’s list, beginning 0x83aeac, was not included in the screenshots reviewed. The listed TRON addresses showed negligible TRX balances at the time of capture, but those balances do not establish how much they previously received or where the funds went.

CZ says early information points to supply-chain attack

Binance founder Changpeng Zhao (CZ) responded to Ledger’s statement in an October 9 post on X. “Based on information so far, it seems to be localized to a supply chain attack with one vendor,” CZ wrote. He said some customers may have bought fake or tampered devices and called for efforts to trace and recover the funds.

CZ’s comments reflect his assessment of the information available at the time. Ledger has not publicly confirmed that a supply-chain attack caused the reported losses.

Tether blacklist reported for one address

An X user posting as ACHIVX said one of the TRON addresses Specter listed, beginning TCGE3xp6, had been added to Tether’s USDT blacklist.

According to the user, the freeze was proposed at 12:08:42 UTC and executed 63 seconds later, when the address held no USDT. The user added that six other TRON and Ethereum addresses from Specter’s list did not have USDT freezes at that time.

The material reviewed did not include a response from Tether. A blacklist entry does not establish that funds were recovered.

CertiK reports broader crypto losses 

CertiK estimated that crypto-related losses reached $766 million in September 2026, making it the year’s worst month at that point. The firm said exploits involving Bitget and Liquid accounted for more than 92% of September’s losses.

In August, CertiK estimated losses from crypto exploits at approximately $215 million. Its Hack3D report for the first half of 2026 recorded $1.32 billion in losses across 344 incidents.

These figures cover broader crypto security incidents and are separate from Specter’s estimate.

Cause of the losses remains unclear

Crypto security commentator Tayvano (@tayvano_) rejected the interpretation that the reports confirmed a Ledger zero-day vulnerability.

“THERE IS ABSOLUTELY NOT,” Tayvano wrote in response to that interpretation. The user also pointed to fake Google advertisements and fraudulent applications as sources of crypto losses.

Another user, unique0x, described the transaction pattern as “a quick cash grab” and suggested stolen recovery phrases or compromised swap activity as possible explanations. Sheeks said they had received scam letters impersonating Ledger alongside scam calls and emails, and questioned whether phishing could explain the reports.

These remain individual users’ assessments, not confirmed findings. On-chain records can show where funds move but do not, by themselves, establish how a wallet was compromised.

Specter’s loss estimate remains unverified, and neither the number of affected customers nor the cause of the reported losses has been confirmed. Ledger’s investigation is ongoing.

Also Read: US to Seize About $1 Billion in Crypto Linked to Iran: Treasury Secretary Bessent 

Follow The Crypto Times on Google News to Stay Updated!     

Daily Crypto Puzzles

Tickerdle Crypto Connections Crypto Crossword