The device sat in its sealed box for three weeks before Maria Chen finally set it up. She had done everything right, or so she thought. She ordered a Ledger hardware wallet from an authorized reseller, kept it unopened until she was ready, and carefully followed the setup instructions. Within 48 hours of transferring her savings, the funds were gone.
Chen’s story, shared on Reddit and later cited by onchain investigator Specter, is one of hundreds now being documented in connection with a single reseller: CryptoBilis, a Southeast Asia-based distributor of Ledger devices that found itself at the center of a bombshell probe this week. On October 9, 2026, Ledger confirmed it is investigating reports that customers lost approximately $87 million in funds after purchasing wallets from CryptoBilis, and the investigation has shaken the crypto community’s assumption that hardware wallets are the gold standard of security.
What We Know About the Ledger-CryptoBilis Incident
Ledger’s statement, posted on X on Friday, October 9, was careful and measured. The company said it had asked CryptoBilis to pause all sales and shipments of Ledger devices while the investigation is ongoing. It has not yet confirmed the total loss figure, how many customers were affected, or what precisely caused the thefts.
What onchain data makes clear is staggering. Specter, a pseudonymous blockchain investigator, traced theft addresses flagged by users across Ethereum, Tron, and Bitcoin and published a tally: total losses of $86 million or more, spread across hundreds of victim wallets. Arkham Intelligence data put the figure at nearly $87 million: approximately $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT.
The leading hypothesis, though unconfirmed, centers on supply chain compromise. A hardware wallet tampered with before delivery, such as one whose recovery phrase is already known to the attacker, would expose every wallet set up on the device. The victim would see no sign of interference during setup, and the attacker could wait days or weeks before draining the funds, making forensic attribution harder. Ledger has asked anyone who purchased a device from CryptoBilis in the past 90 days not to set it up; those who already have are urged to transfer funds to a new wallet immediately.
Hardware Wallets Under Siege: The Coldcard Precedent
The CryptoBilis probe did not emerge in a vacuum. It follows one of the most technically alarming hardware wallet incidents in crypto history: the Coldcard firmware bug disclosed in late July 2026 that exposed an estimated 1,596 BTC from approximately 7,300 addresses, with broader estimates placing the total above 2,055 BTC, worth well over $130 million at current prices.
The Coldcard vulnerability was not a supply chain attack but a firmware flaw. A bug in the device’s code replaced its hardware random number generator with a predictable fallback in certain conditions, meaning that private keys generated during affected periods could be brute-forced by a sufficiently resourced attacker. Galaxy Research, which analyzed the incident, rated the finding high confidence. Users were advised to generate new seed phrases on patched firmware and move funds immediately.
Two major hardware wallet security incidents in the same quarter, one a possible supply chain compromise and one a firmware flaw, signal that the hardware wallet security model is under greater stress than the industry has publicly acknowledged.
The Bigger Picture: Crypto’s $1.3 Billion Security Crisis in 2026
Zoom out, and the Ledger and Coldcard incidents are part of a brutal year for crypto security. According to data compiled by CertiK and reported by Crypto.news, DeFi protocols alone lost more than $1.3 billion to exploits in the first eight months of 2026, and the pattern of how that money was stolen has shifted dramatically.
The two largest single incidents of the year remain jaw-dropping in their scale and sophistication:
- KelpDAO (April 18, $292 million): Attackers compromised the RPC infrastructure feeding a single-verifier LayerZero bridge, then DDoS’d external nodes to prevent any challenge. Compromised nodes signed a forged message, minting 116,500 unbacked rsETH tokens. The attackers used them as collateral on Aave to borrow WETH, sending Aave’s total value locked down $6.28 billion in 48 hours. Investigators linked the attack to North Korea’s Lazarus Group.
- Drift Protocol (April 1, $285 million): A months-long social engineering campaign culminated in attackers obtaining pre-signed authority from the protocol’s Security Council. They listed a worthless token against a fake oracle they controlled and drained the protocol in 128 seconds. A prior audit had flagged the oracle validation gap but classified it as informational.
Together, these two attacks account for more than $575 million in losses, both attributed by investigators to Lazarus Group’s TraderTraitor subunit, the same North Korean state-sponsored team behind the $1.5 billion Bybit theft in February 2025.
The Attack That Keeps Working: Private Keys Over Code Bugs
For years, crypto security discourse focused on smart contract audits as the primary defense against hacks. That model is now visibly failing. As CertiK’s head of security research, Ronghui Gu, put it directly: “A protocol can pass a flawless code audit and still lose millions because of a compromised admin key.”
CertiK’s data shows that in 2026, compromised private keys overtook smart contract bugs as the leading attack vector by dollar value, a first in the industry’s recorded history. The pattern appears repeatedly across the year’s largest incidents: Step Finance lost $27.3 million when a compromised executive device likely exposed treasury keys; IoTeX’s ioTube bridge was hit after validator key compromise enabled a malicious upgrade; and KelpDAO’s catastrophic loss hinged not on broken code but on compromised signing infrastructure.
Even bridge security, long identified as DeFi’s Achilles heel, increasingly comes down to key management. Of LayerZero’s deployed OApps, 47 percent, over 1,200 contracts, still use single-verifier configurations even though multi-verifier setups are supported. A single compromised verifier is all it takes.
What This Means for You
If you hold cryptocurrency, whether on a hardware wallet, a software wallet, or a DeFi protocol, the events of 2026 carry direct practical lessons:
- Buy hardware wallets only from manufacturers directly. Purchase directly from Ledger, Trezor, or Coldcard’s own websites. If you must use a reseller, verify the device’s seal and anti-tamper packaging before setup.
- Generate a new seed phrase on updated firmware. If you own a Coldcard purchased before August 2026, assume your seed phrase may be at risk and migrate your funds to a new wallet with freshly generated keys on patched firmware.
- Revoke unlimited token approvals. Tools like Revoke.cash let you audit and remove approvals your wallet has granted to DeFi contracts. The SwapNet exploit drained $13.4 million through unlimited approvals in January 2026 alone.
- Favor protocols with multi-sig governance and timelocks. Protocols that require meaningful quorum and delay privileged operations give the community time to catch anomalies before funds are moved.
- Treat key management as your primary security concern. Audited code is not a substitute for operational security. Admin keys, validator credentials, and session keys are the real targets in 2026’s threat landscape.
An Industry at an Inflection Point
There is a temptation, after a year like this, to conclude that crypto security is simply unsolvable, a game of whack-a-mole against adversaries with nation-state resources. That reading is too pessimistic. The security layer that most users rely on has now been compromised at both the firmware and supply chain levels in the same quarter. DeFi’s biggest losses have come not from broken code but from the human and operational vulnerabilities that audits were never designed to catch.
The fixes are known: multi-party computation signing, hardware-backed threshold keys, multi-verifier bridge configurations, governance safeguards with real quorum requirements, and rigorous operational security programs. The question is whether the industry will invest in them before the next $100 million disappears.
Maria Chen’s funds have not been recovered. The addresses Specter flagged remain active. Ledger’s investigation is ongoing. And somewhere in Southeast Asia, the devices that have not yet been set up are still sitting in sealed boxes, waiting.
Sources:
Ledger Probes Potential Theft of $87M in User Funds Tied to Crypto Wallet Reseller — Decrypt
DeFi Has Lost $1.3 Billion to Hacks in 2026 and the Same Attack Keeps Working — Crypto.news
Biggest DeFi Hacks and Exploits of 2026: $1 Billion+ Lost and Counting — CCN
July 2026 Crypto Hacks: $242M+ Lost as a Hardware Wallet Bug Outweighed Every DeFi Exploit — CoinMonks
Stolen Keys Beat Code Bugs as DeFi Hacks Hit $1.3B in 2026 — Shattered.io
