On 9 October 2026, more than 300 self-custody wallets were emptied, most of them within about an hour, according to the timeline reconstructed by blockchain analytics firm Bitquery. The common thread was not a bug in a wallet app or a hacked exchange. According to Ledger, every confirmed case so far involves hardware wallets bought through one authorised reseller, CryptoBilis, which sold devices in Indonesia, Malaysia and the Philippines.
Most coverage led with the loss of around US$86 million to US$93 million. The detail that matters more for Southeast Asia is in the on-chain breakdown: by Bitquery's count, about three quarters of the money taken was USDT on the TRON network, a centrally issued stablecoin. That is why part of it could be frozen.
The case belongs on the agenda when the industry meets at Web3 Week Asia in Jakarta on 11-12 November 2026. All figures are as of 07:30 WIB, 13 October 2026.
What Ledger confirmed. On 10 October Ledger said one affected user's device contained an unauthorised hardware implant, and that its own systems and direct sales channels show no sign of compromise.
Estimated losses. On-chain researchers put the total at US$86 million to US$93 million across more than 300 wallets. Ledger has not published an official figure.
Where the reseller operated. CryptoBilis was listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines, according to The Block, CoinDesk and FXStreet.
What was frozen. Tether froze about US$10 million in USDT linked to the theft, according to Bitquery and Crypto Briefing.
What buyers are told to do. Ledger advises anyone who bought from CryptoBilis in the past 90 days not to set up an unused device, and to move funds already on such a device to a new seed on hardware bought directly from Ledger.
How the drain unfolded
Bitquery's reconstruction describes a coordinated operation rather than scattered thefts. On TRON, about 30 wallets first had a new key added to their permissions, giving the attacker control. Pulls from other TRON wallets began minutes later, and around 111 bitcoin wallets were emptied in a single block.
Bitquery counts 315 victim wallets and US$93.2 million taken on six chains. Earlier estimates came from the researchers Specter (more than US$86 million) and tanuki42 (more than US$72 million). Bitquery says the US$86 million count covered only ten public addresses.
Why it matters: the timing suggests one actor held keys to many wallets at once, which is why the shared distribution channel, not individual user error, is the focus of the investigation.
The stablecoin detail most coverage skipped
By Bitquery's breakdown, about US$70.5 million of the US$93.2 million came from 131 TRON wallets, mostly in USDT. That is roughly 76% of the total. Bitcoin accounted for about US$16.8 million (203.8 BTC), and four other chains made up the rest. This split comes from one analytics firm and may be revised.
The concentration cuts both ways. USDT is centrally issued, so Tether can blacklist addresses, and it froze about US$10 million across more than 20 linked addresses, according to Bitquery and Crypto Briefing. The attacker responded by swapping roughly US$15 million of USDT into USDD, a TRON-based stablecoin outside Tether's freeze controls; Crypto Briefing reported about 14.7 million USDT converted, Bitquery about US$14.9 million. Ether, 2,990 ETH in total, was routed through Tornado Cash, according to Bitquery and KuCoin's market report.
Why it matters: a freezable stablecoin gave victims a partial safety net that bitcoin did not, but only for the share that stayed in USDT. Bitquery estimated about US$81 million was still traceable on-chain as of 06:00 UTC on 11 October, down from US$88 million a day earlier.
Who controlled the reseller is an open question
Ownership of CryptoBilis is now part of the story, but the facts conflict. A BlockBeats report, relayed by KuCoin, cited company records showing that a single individual has held 100% of CryptoBilis shares since 3 August 2026. A former co-founder said the company was acquired in March and that the original founders are "no longer part of the company". Those two dates do not match, and no report has established a link between the ownership change and the theft.
Other wallet makers are reacting anyway. OneKey said on 12 October it had revoked CryptoBilis's authorisation and would replace, free of charge, its devices bought there between 1 March and 12 October 2026, according to Crypto Times. Crypto Times also reported that CryptoBilis listed itself as a reseller for more than a dozen hardware brands.
Why it matters: an authorised reseller badge tells a buyer the brand approved the shop at some point. It does not tell the buyer who owns the shop today.
The honest counterweight
One implant, not hundreds. Ledger has confirmed an implant in one affected device. Whether every drained wallet was compromised the same way has not been established.
No official loss figure. Every loss number here comes from on-chain researchers. Ledger has not confirmed a total, and figures may be revised.
No count of Indonesian victims. None of the reports reviewed gives victims by country, and no Indonesian authority statement had been reported as of 13 October 2026.
What the case means for Indonesia crypto users
OJK licenses Indonesia's crypto exchanges, clearing houses and custodians. Hardware wallet resellers sit outside that perimeter: they sell devices, not financial services. The case shows that self-custody, often presented as safer than leaving coins on an exchange, carries a supply-chain risk that local licensing does not cover.
For users, the vendors' guidance is the practical lesson: buy directly from the manufacturer where possible, treat a device bought from CryptoBilis in 2026 as suspect, and never share a recovery phrase. Both Ledger and OneKey say they will never ask for one.
For the industry, open questions remain: who checks the ownership of authorised resellers, and how fast issuers and exchanges can act on traced funds. Bitquery reported about 5.2 million USDT sent to Binance deposit addresses on 10 and 11 October.
Web3 Week Asia 2026: blockchain event in Jakarta, 11-12 November
Web3 Week Asia returns to Jakarta on 11-12 November 2026, at the Grand Ballroom at Kuningan City according to the official site. The two-day programme runs four tracks: Investor Meetups, Alpha Callers, Web3 Entrepreneur and Indonesia Crypto Outlook 2026.
The CryptoBilis case touches regulators, stablecoin issuers, exchanges and retail users across three Southeast Asian markets at once, the mix of participants the event brings together. The organisers report that the 2025 edition drew more than 5,000 participants, over 100 speakers and more than 200 companies from more than 10 countries. The 2026 speaker line-up is to be announced.
Frequently asked questions
When and where is Web3 Week Asia 2026?
Web3 Week Asia 2026 takes place on 11-12 November 2026 in Jakarta, Indonesia. It is a two-day crypto and blockchain event covering markets, regulation, infrastructure and venture investment across Southeast Asia.
What happened to Ledger wallets sold by CryptoBilis?
On 9 October 2026, more than 300 wallets linked to devices sold by CryptoBilis were drained. Ledger confirmed an unauthorised implant in one affected device. On-chain researchers estimate losses of US$86 million to US$93 million.
Were Indonesian users affected?
CryptoBilis sold in Indonesia, Malaysia and the Philippines, but no public report reviewed gives a count of victims by country.
What should someone who bought a wallet from CryptoBilis do?
Ledger advises not setting up an unused device bought there in the past 90 days, and moving funds on a device in use to a new seed on hardware bought directly from Ledger.
Was any of the stolen money recovered?
Tether froze about US$10 million in USDT linked to the theft. That is a freeze, not a confirmed return to victims, as of 13 October 2026.
Sources
Bitquery investigation of the CryptoBilis drain: https://bitquery.io/investigations/ledger-cryptobilis-hack
CoinDesk on Ledger's implant confirmation: https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis
Ledger's statements and the reseller's markets are from The Block (9 October 2026), FXStreet (10 October 2026) and CoinDesk (12 October 2026). Loss estimates are from Specter and tanuki42 as reported by The Block, and from Bitquery (10-11 October 2026). The per-chain breakdown, the Tornado Cash total and the remaining on-chain balance are from Bitquery, with the Tornado Cash figure also reported by KuCoin. The Tether freeze and USDD swap are from Bitquery and Crypto Briefing. OneKey's replacement programme is from Crypto Times (12 October 2026). The ownership records are from BlockBeats as relayed by KuCoin (10 October 2026).
Methodology: The 76% TRON share is US$70.5 million divided by US$93.2 million, both from Bitquery; it rests on one firm's attribution and is not presented as a confirmed figure. Total losses are given as a range because researchers counted different sets of addresses at different times, and the estimates were not summed. The roughly US$15 million USDD figure rounds two reports that differ slightly (14.7 million and 14.9 million). Rupiah conversions and an unverified allegation that attackers bought the reseller were excluded.
This article is for information only and is not investment advice.
