The loss figures attached to Ledger's CryptoBilis investigation don't agree with each other, and the company hasn't confirmed any of them. On October 9, 2026, Ledger said it is looking into fund losses among people in Southeast Asia who bought from reseller CryptoBilis. The big totals you may have seen are still estimates from outside the company.
If you hold a Ledger, that gap is the story. The company has confirmed a reseller-scoped investigation and published setup advice for buyers from that seller. A flaw in Ledger firmware or hardware across the product line remains unconfirmed. Treat an outside loss total as an estimate, not as a damage figure the company has settled.
The support post spells the reseller CryptoBilis, and also CryptoBillis. Ledger asked that seller to pause all sales and shipments while the investigation runs. That pause covers the next shipment. It is not a recall of every signer already in a drawer. The note is aimed at people who bought from this reseller in the last 90 days, and it sends questions to official support. A reseller thread, a stranger's reply, or a form that showed up in your inbox is not that channel.
The cause is still open. A tampered device, a recovery phrase that was already exposed when the package arrived, or a phishing path could fit the reports. None of those is established. A supply-chain attack stays a hypothesis. Nobody has confirmed a firmware bug that every Ledger shares. A large estimate doesn't settle which of those paths it was. The size of the loss and the way it happened are separate questions, and only Ledger's investigation can close either one.
Outside estimates put the suspected losses at about $70 million (Bloomberg Law), above $72 million (The Block), and above $86 million (CoinDesk). Ledger hasn't confirmed any of those totals, and it hasn't published a victim count. An early description of hundreds of wallets was later withdrawn, so the number of affected wallets is still unknown. It also isn't clear the larger tallies cover the same addresses. They can sit in the same headline and still be three unfinished counts.
The company said the information it had so far indicated the affected wallets were bought from CryptoBilis, described as a Malaysian reseller. It had no reports about devices purchased directly from Ledger, or about its own infrastructure, systems, and services. CryptoBilis is also listed as an official Ledger reseller in Indonesia, Malaysia, and the Philippines. The buyer note doesn't name those countries. It says Southeast Asia, which is the region those listing markets sit in. If a post offers you one number and calls it the damage, you're looking at an outside count. Ledger hasn't picked one, and it hasn't blended them into an official total.
Social posts have already picked a cause to go with the number. Some call it tampered hardware from a single seller. Some paste a total and treat it as finished. Read those as unverified tips. The finding, when there is one, will have Ledger's name on it.
If you bought from CryptoBilis
If your purchase falls inside the 90 days Ledger named, stay with the company's instructions. Leave the device unset when you haven't started setup. When a seed from that device is already in use, move the coins onto a new Ledger signer and create the new seed on that replacement. Don't type the old recovery phrase into the new device. Buy the replacement from Ledger, or from a seller outside this case. CryptoBilis is the seller just told to stop shipping. Contact Ledger only through its official support.
If your Ledger came from another seller, keep this in the reseller column. What's confirmed is an investigation and advice for buyers in Southeast Asia. Wait until Ledger names a cause before you decide your own device belongs in the case. A screenshot of a loss total doesn't make every signer unsafe.
Photo: Motokoka / Wikimedia Commons, CC BY-SA 4.0.
