Thirty days before Web3 Week Asia opens in Jakarta, the most important crypto story for Indonesian users did not come from a regulator or a price chart. It came from a hardware wallet box. On 9 October 2026, users who bought Ledger devices through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines, began reporting drained wallets.

 

On-chain analysts put the losses between US$72 million and US$93 million. Ledger has confirmed none of those figures, but on 10 October it confirmed that one affected user's device contained an unauthorized hardware implant. For a market that OJK counts at 23.21 million crypto consumer accounts, that is a reminder that self-custody is only as safe as the supply chain behind it.

 

Web3 Week Asia takes place on 11-12 November 2026 in Jakarta. This countdown covers what changed since the 40-day mark and what is still on the calendar.

 

Days to go. 30, counted from Monday 12 October 2026 to Wednesday 11 November 2026.

 

Security. Ledger confirmed a hardware implant in one CryptoBilis-sold device on 10 October 2026; loss estimates from on-chain analysts range from US$72 million to US$93 million and are unconfirmed by Ledger.

 

Indonesian market. Spot crypto transactions reached Rp23.16 trillion in August 2026, up 12.87% from July 2026, according to OJK data reported on 5 October 2026.

 

Bitcoin. About US$83,660 as of 06:18 WIB on 12 October 2026, according to CoinDesk and CoinGecko, with no move larger than 1% over the preceding 24 hours.

 

Rates. BI-Rate at 5.75% after the 22-23 September 2026 meeting; the US federal funds target range at 3.75% to 4.00% after the 16 September 2026 hike.

 

What changed since the 40-day mark: a supply-chain attack in the region

 

The CryptoBilis incident matters for Indonesia because the reseller sold into the Indonesian market, not because Ledger's own systems failed. Ledger said on 10 October 2026 that it found no sign its infrastructure, systems or services were compromised. What it did confirm is narrower: one affected device carried hardware that should not have been there.

 

The figures diverge because analysts traced different addresses. Specter cited more than US$86 million on 9 October 2026, tanuki42 cited more than US$72 million, and Bitquery estimated about US$93.2 million across 315 wallets as of 07:00 UTC on 10 October 2026. According to Bitquery, roughly three quarters of that total, US$70.5 million, sat on TRON, mostly as USDT. Bitquery also reported that Tether froze about US$10 million in USDT linked to the theft. The estimates overlap, so they are given as a range, not added together.

 

Ledger's guidance to CryptoBilis buyers is specific: do not set up a device bought from the reseller in the past 90 days, and if a device is already in use, move funds to a new wallet created with a completely new recovery phrase. Restoring the old phrase onto a new device does not remove the exposure. Why it matters: the attack, as reported, bypasses the usual advice to buy only from authorised sellers, because CryptoBilis was listed as an official Ledger retailer.

 

No Indonesian victim count and no statement from an Indonesian authority had been reported as of 12 October 2026.

 

What changed in the numbers: OJK's August data

 

OJK's August 2026 figures, released after its September board meeting and reported on 5 October 2026, show spot transactions of Rp23.16 trillion, up from Rp20.52 trillion in July 2026. Derivative transactions on digital financial assets reached Rp4.56 trillion, up 33.76% month on month. OJK also listed 28 licensed digital financial asset traders, the most recent licensed on 22 September 2026.

 

Why it matters: accounts grew only 1.23% to 23.21 million while volume rose 12.87%, so volume grew about ten times faster than the account base; OJK's data does not show which users or assets drove it.

 

What is still on the calendar before Jakarta

 

Five scheduled events fall inside the 30-day window. On Friday 16 October 2026, feedback closes on the Monetary Authority of Singapore consultation on its stablecoin framework, which proposes a dedicated issuance licence and full reserve backing at par. On 20-21 October 2026, Bank Indonesia's Board of Governors meets. The US Federal Open Market Committee meets on 27-28 October 2026, with the decision landing in the early hours of 29 October in Jakarta time; the Fed's September projections pointed to one more quarter-point hike before the end of 2026.

 

On Saturday 31 October 2026, the court-approved deadline for Mt. Gox creditor repayments arrives, after the trustee pushed it back by a year in October 2025. On Tuesday 3 November 2026, the US holds its midterm elections, which will shape whether market-structure legislation has a path after the CLARITY Act failed a Senate procedural vote on 15 September 2026.

 

Why it matters: all of these land before 11 November, so Jakarta's discussions start from known outcomes.

 

The honest counterweight

 

The loss figures are not official. Every dollar estimate for the CryptoBilis incident comes from independent on-chain analysts. Ledger has confirmed an implant in one device, not the scale of the theft or that the implant caused it.

 

Higher volume is not higher adoption. One month of rising transactions is not a trend, and OJK does not break volume down by user type.

 

A calendar is not a forecast. Listing the Bank Indonesia and Fed meetings says nothing about their outcomes; this article does not predict them.

 

Indonesia crypto: what the month means locally

 

For Indonesian users, the month combines two very different signals. The regulated side keeps getting more formal: 28 licensed traders, monthly reporting from OJK, and a regulation, POJK 23/2025, that was promulgated on 10 November 2025, one day short of a year before Web3 Week Asia opens. The self-custody side has just seen a regional supply-chain attack on devices sold through an official channel.

 

For users, Ledger's own instruction is the clearest available step: a new device and a new recovery phrase.

 

Web3 Week Asia 2026: blockchain event in Jakarta, 11-12 November

 

Web3 Week Asia runs on 11-12 November 2026 in Jakarta, at the Grand Ballroom at Kuningan City according to the official site. The programme is organised into four tracks: Investor Meetups, Alpha Callers, Web3 Entrepreneur and Indonesia Crypto Outlook 2026. The topics in this countdown, from custody security to OJK data and regional stablecoin rules, sit inside that last track's scope.

 

The 2025 edition drew more than 5,000 participants, over 100 speakers and more than 200 companies from more than 10 countries, according to the organisers. The 2026 speaker line-up is to be announced.

 

Frequently asked questions

 

When and where is Web3 Week Asia 2026?

 

Web3 Week Asia 2026 takes place on 11-12 November 2026 in Jakarta, Indonesia. It is a two-day crypto and blockchain event covering markets, regulation, infrastructure and venture investment across Southeast Asia.

 

What happened with Ledger devices sold by CryptoBilis?

 

From 9 October 2026, buyers of Ledger devices from CryptoBilis, a reseller in Indonesia, Malaysia and the Philippines, reported drained wallets. Ledger confirmed a hardware implant in one device on 10 October; analyst loss estimates of US$72 million to US$93 million are unconfirmed.

 

What should CryptoBilis buyers do?

 

Ledger advises not setting up a CryptoBilis device bought in the past 90 days, and moving funds from any device in use to a new wallet with a new recovery phrase.

 

How big is Indonesia's crypto market right now?

 

According to OJK, spot crypto transactions were Rp23.16 trillion in August 2026 and there were 23.21 million crypto consumer accounts, with 28 licensed digital financial asset traders.

 

Which events fall between now and Web3 Week Asia?

 

The MAS stablecoin consultation closes on 16 October 2026, Bank Indonesia meets on 20-21 October, the Fed meets on 27-28 October, the Mt. Gox repayment deadline is 31 October, and the US midterm elections are on 3 November 2026.

 

Sources

 

Ledger investigation report, CoinDesk, 9 October 2026: https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen

 

Earlier W3W countdown, Web3 Week Asia in 40 Days: https://www.w3w.asia/articles/web3-week-asia-2026-40-days-jakarta

 

Ledger incident: CoinDesk (9 October 2026), crypto.news (11 October 2026), Bitquery (10 October 2026), CryptoTicker (9 October 2026) and Liputan6 (11 October 2026). OJK August data: Bloomberg Technoz and Investortrust (both 5 October 2026), citing OJK. Bitcoin price: CoinDesk and CoinGecko, 12 October 2026. Rates: Bank Indonesia September 2026 decision as reported by Warta Kepri; Fed decision per CNBC and StockTitan (16 September 2026); meeting dates from the Federal Reserve calendar and Bank Indonesia's 2026 RDG schedule as reported by Metro TV News. MAS consultation: Sidley Austin (September 2026). Mt. Gox deadline: Yahoo Finance (October 2025). CLARITY Act vote: Bitcoin.com News and The Defiant (September 2026). POJK 23/2025 promulgation date: pasal.id. Event facts: Web3 Week Asia official site as of 2 October 2026.

 

Methodology: The 30-day count runs from 12 October to 11 November 2026. Ledger loss estimates from Specter, tanuki42 and Bitquery trace different address sets, so they are shown as a range of US$72 million to US$93 million and not summed. The TRON share was computed as US$70.5 million divided by US$93.2 million, about 76%, using Bitquery's figures only. Month-on-month changes for OJK data were checked against the reported July and August values. Tallies for the CLARITY Act vote differ between sources, so only the outcome is reported. No Indonesian victim count was found, so none is given. Ticket prices are excluded.

 

This article is for information only and is not investment advice.