Ledger Reported Breach Linked to Southeast Asia Reseller
The hardware wallet manufacturer confirmed devices sold via a third party were compromised in an October incident.
Updated on Oct. 12, 2026 in Cybersecurity
Live Poll
Do you trust the security of hardware cryptocurrency wallets purchased from third-party resellers?
Ledger has identified a security breach involving hardware wallets sold through the reseller CryptoBilis in Southeast Asia. On-chain researchers report that the incident resulted in cryptocurrency losses exceeding $93 million.
Why it matters
The breach highlights the security risks inherent in the third-party hardware supply chain for cryptocurrency storage. Because the compromise occurred outside of the company's direct distribution channels, it underscores the need for supply chain integrity even for secured hardware devices.
On-chain researchers confirmed the drain of assets totaling $93 million following the October 9, 2026, incident. Ledger stated that its internal systems and direct-to-consumer sales channels remained unaffected throughout the 72-hour investigation period.
The players
Ledger
A Paris-based manufacturer of hardware wallets used for the secure offline storage of cryptocurrency private keys.
CryptoBilis
A reseller operating in Southeast Asia that distributed the compromised hardware wallets.
The details
The compromise involved hardware wallets—physical devices designed to keep private keys offline—that were distributed via the Southeast Asian reseller CryptoBilis. Ledger confirmed that the breach was localized to devices sold through this specific reseller. The company maintains that its core internal systems, which generate the cryptographic signatures required to authorize wallet transactions, were not breached.
Timeline
October 9, 2026: The initial wallet-draining incident occurred.
October 11, 2026: Ledger issued a 72-hour update on the X platform.
The Tech Race
This breach marks a departure from typical hardware-level vulnerabilities by focusing on the integrity of third-party retail channels. It highlights an ongoing challenge for security firms that must now verify the supply chain security of regional resellers globally.
Users who purchased devices from non-official sources in Southeast Asia should immediately check their wallet status and move funds if possible. Ledger has clarified that users purchasing directly from their official site are not affected by this reseller-specific breach.
The takeaway
This incident serves as a critical reminder to verify the authenticity of all third-party vendors when purchasing hardware security equipment. Readers should monitor future Ledger updates for official guidance on identifying compromised batches or potential recovery programs.
Further reading
Learn more about the latest developments in Cybersecurity to understand the evolving threats to digital asset infrastructure.
Live Poll
Do you trust the security of hardware cryptocurrency wallets purchased from third-party resellers?
