Ledger and the reported theft.

Oct 9, 2026, 15:45 UTC

Ledger and the reported theft

Ledger says it is investigating reports of losses among South East Asian customers who bought devices from reseller CryptoBillis. It asked the reseller to pause sales and shipments. Ledger advises customers who bought from it in the last 90 days not to set up unused devices; those who already set one up should consider moving assets to a new Ledger signer with a new seed. The investigation’s cause and total loss remain unconfirmed in Ledger’s statement: Ledger Support.

Reported amounts and linked wallet

The supplied coverage attributes losses exceeding $86M across hundreds of wallets on Ethereum, Tron and Bitcoin to on-chain analyst Specter; Ledger has not confirmed that estimate. Lookonchain separately reported that the Tron address TY24…Wg6D received 7M USDT and later sent 7,001,000 USDT to TK6D…vXT6C, which Arkham labels “CryptoBillis Ledger Drainer.” The reported 7M theft is therefore supported by the token transfers, while the attribution of that wallet to a particular Ledger customer and the reason the funds were accessible are not established by those transfers: Lookonchain’s post.

What remains uncertain

The sources do not establish how the loss occurred, confirm that devices or Ledger software were compromised, or independently verify the reported $86M+ aggregate. Ledger’s statement · Lookonchain’s post · linked Tron address · Arkham-labeled destination

Ask your own

Case file

Answered Oct 9, 2026, 15:45 UTC

Sources 4

Research trace 10

The page get.kolo.xyz
The page www.okx.com
The page waitlist.arcus.xyz
The page arkm.com
The supplied posts report Ledger’s precautionary response, a nearly $90M multi-victim loss, and a 7M USDT theft attributed to the linked Tron address. These independent reads can verify Ledger’s exact statement, locate corroborating coverage, and inspect the address’s public token-transfer history.
The linked Tron address sent 7,001,000 USDT to a second wallet after receiving deposits totaling 7M USDT. These reads can label the recipient and show whether those funds moved onward.
The first reads show 7M USDT deposited to the linked address and a subsequent 7,001,000 USDT transfer to the address Arkham labels “CryptoBillis Ledger Drainer.” These independent reads can check the destination’s known identity, its current account state, and the outgoing transaction details.
The linked wallet’s newest Tron USDT transfers and any available attribution, following the 7,001,000 USDT transfer to the Arkham-labeled drainer.
The supplied Ledger post confirms the investigation and its precautionary advice, while on-chain results show the victim address received 7M USDT and then sent 7,001,000 USDT through wallets labeled by Arkham as the CryptoBillis Ledger Drainer. These reads seek a source for the broader loss estimate and trace the two largest onward transfers from the intermediate wallet.
The supplied Ledger post and linked X posts establish the current public account: Ledger is investigating reports tied to CryptoBillis, has asked the reseller to pause sales and shipments, and advises recent buyers not to set up unused devices or to move assets to a new signer with a new seed. On-chain data confirms that the linked Tron address received 7M USDT and sent 7,001,000 USDT to an address Arkham labels “CryptoBillis Ledger Drainer.” The broader $86M+ estimate is attributed in the supplied material to analyst Specter and is not confirmed by Ledger; the $7M report comes from lookonchain. The available sources do not establish the cause or independently substantiate the aggregate total.