Ledger CryptoBilis reset advice may also cover June buyers

Ledger's reset advice covers people who bought from CryptoBilis, a reseller in Southeast Asia, in the last 90 days. The wallets drained on Oct. 9 point further back. In an investigation by Bitquery with data through Oct. 16, 2026, 6 in 10 drained TRON, Bitcoin and Ethereum wallets first received coins inside that window. More than 8 in 10 did so from June onward, and the on-chain analytics firm says June buyers should treat Ledger's advice as theirs too.

Bitquery extends Ledger's reset advice to June buyers

In Bitquery's reading, the June cluster of 43 wallets on TRON alone suggests the risk may reach back about four months. A wallet's first coins can arrive later than the device purchase. That makes the June finding a pointer, short of proof.

In Ledger's account, hidden components fitted into genuine devices were designed to capture the recovery phrase during setup. That phrase is the 24 words that can restore your wallet on any device. The fix is a new device with a new phrase:

• Hold off on setting up an unused device bought from CryptoBilis.
• If you already set one up, move your assets to a new Ledger device.
• Create the new recovery phrase on that device, with our cold wallet setup guide as a walk-through.
• If you bought in June, take the same steps.

Ledger never calls, texts or asks for your phrase

Ledger's phishing status page, as of Oct. 18, 2026, sets out how to tell the company from someone posing as it:

• Ledger communicates only by email and through official social media channels.
• It never contacts you by text message or phone call.
• Neither Ledger nor its support staff will ask for your 24-word recovery phrase.
• It sends no emails asking you to update device firmware or to enable two-factor authentication.

Ledger's Oct. 15 post sets new store rules that show how a genuine device should reach you. Effective immediately, authorized resellers and distributors must keep Ledger products off shelves and displays. Stock stays in the back until the time of purchase, and resellers must promptly report any customer report of an unusual product. The post also reminds them of an existing rule: returned devices can never be resold.

Whether a given loss came from an implant or from a key that leaked another way is still open. Bitquery says the answer will come from Ledger's examination of more devices. Separately, Ledger's Oct. 15 post promises more details and, when it can, a fuller technical disclosure for industry peers, with no date set.

German reports test Ledger's local-attack account

Ledger's Oct. 11 statement on CryptoBilis-sold devices, quoted by Unchained, tied all confirmed cases from the Oct. 9 drain to devices sold through CryptoBilis.

The Oct. 15 post lays out how the company sees the attack. A criminal group spent many months buying genuine devices, fitting the hidden components and returning the devices to distribution through resellers in Southeast Asia. Ledger rules out a flaw in its chip, operating system or servers and calls the attack localized rather than systemic.

On Oct. 13, Ledger asked its authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. Bitquery's timeline lists seven markets: Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

Ledger confirmed an unauthorized hardware implant in one affected user's device on Oct. 10, the one device-level confirmation so far. Its teams also spot-bought and opened a number of store devices in markets including Germany and examined warehouse samples. Ledger found every unit it examined clean.

Two reports from Germany cut the other way. MediaMarkt Saturn halted Ledger sales on Oct. 13 after a customer in Germany reported an implant. Ledger said no loss of funds was reported in that case. TokenPost reports that the halt was coordinated with Ledger.

TokenPost also carries a claim by Mark Karpeles: he found a spy implant in a Ledger Nano X bought at MediaMarkt in Germany. An X user sent him the device, which arrived Oct. 15. Ledger had not yet examined the devices shown online, so the find rests on his word. None of the reports alleges misconduct by MediaMarkt.

Bitquery counts $102.0 million from 335 wallets

Bitquery counts $102.0 million taken in the Oct. 9 drain from 335 victim wallets on six chains: TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana. The count values outflows at morning Oct. 9 prices, with data through 14:40 UTC on Oct. 16, 2026. One person can hold several wallets, so 335 wallets can belong to fewer people.

In an Oct. 15 post on X, Chainalysis said one of the biggest victims of the theft ran a task scam. That victim lost more than 60 BTC, about $4.8 million. A task scam lures people with small payouts for online tasks before taking their deposits.

On chain, three drained Bitcoin addresses each received two equal payments from one wallet on the evening of Sept. 22. All three were emptied in the main Bitcoin drain block at 05:54 UTC on Oct. 9, 60 BTC in all.

At Bitquery's morning Oct. 9 price of $82,300 per bitcoin, those 60 BTC come to about $4.9 million. That is about 4.8% of the $102.0 million total, both figures at morning Oct. 9 prices. More than 95% of the counted drain came from other wallets.

Tether, the issuer of the USDT dollar stablecoin, blocked 37 addresses linked to the theft on Oct. 9. Twenty of them held half a million USDT each, so $10.0 million sits frozen as of Oct. 16. Tether later lifted the block on four THORChain vault addresses. The freeze stops the coins from moving, but it sends nothing back to victims.

Chain timing points to one key holder

A skeptic can ask whether the Oct. 9 transfers were signed in advance. In that case, a fake site would have gathered signed requests from many people over a day and sent them all at once. Bitquery tested that idea and rates it unlikely.

Its evidence is timing. Approvals, the permissions that let another address move a wallet's tokens, landed in sync with transfers across the drained wallets. From that pattern, Bitquery concludes that one actor held the keys to every drained wallet.

For your device, the document to watch is the fuller technical disclosure Ledger says it will give industry peers when it can. If it names a purchase window or serial range, you can check your receipt and device against it.