Ledger Investigates $86M Wallet Drains Tied to SEA Reseller CryptoBilis

An estimated $86 million in Bitcoin, Ethereum and Tron has been linked to suspected theft from wallets purchased through CryptoBilis, a Ledger-authorised reseller in Indonesia, Malaysia and the Philippines. Ledger has halted the reseller's sales and shipments, advised buyers from the past 90 days to pause device setup, and is urging those who have already configured a device to migrate assets to a new signer immediately. For accounting firms, auditors and CFOs with regional clients holding self-custodied digital assets, this is not a background story: it is an active custody risk event with real financial reporting and AML obligations attached to it.

What Has Been Reported So Far

Ledger confirmed on 9 October 2026 that it is investigating reports of fund losses from users in Southeast Asia who acquired its hardware wallets from CryptoBilis. The company stated it has asked CryptoBilis to pause all sales and shipments while the investigation is ongoing.

The loss estimates

Two onchain researchers produced separate estimates. The first, tanuki42, identified a cluster of suspected theft addresses and placed initial losses above $72 million. A second researcher, Specter, traced flows across Bitcoin, Ethereum and Tron addresses and arrived at a figure exceeding $86 million. Both sets of figures are unconfirmed and it is not clear whether they cover the same transactions or the same address set. Ledger itself has not verified either total.

The suspected attack vector

The cause of the losses has not been officially established. However, the pattern of reports has led several observers to suspect a supply chain compromise. Former Mt. Gox CEO Mark Karpeles, who said he was already aware of a related issue, asked affected users to open their devices and photograph the circuit board, stating the images could reveal whether hardware had been physically tampered with. Binance co-founder Changpeng Zhao separately stated that available information pointed to a supply chain attack involving one vendor, suggesting some users may have received counterfeit or altered devices. Zhao called on exchanges across the BNB ecosystem and the wider industry to assist with tracing and recovery, while noting that self-custody carries additional responsibilities for users.

Ledger's advisory to buyers

Ledger's public guidance via X is direct. Anyone who purchased from CryptoBilis in the past 90 days and has not yet set up their device should not do so. Those who have already set up a device are advised to generate a new seed phrase on a separate, uncompromised device and transfer all assets to the new signer. The company stated it will continue to update customers as the investigation proceeds.

Why This Matters for Accounting Firms and CFOs

A suspected theft of this scale, touching clients across three Southeast Asian markets, creates overlapping obligations that go well beyond watching the news feed.

Asset impairment and financial reporting

Under both IFRS and most local GAAP frameworks applied across Indonesia, Malaysia and the Philippines, digital assets held by an entity are typically recognised as intangible assets or, where a fair value model is elected, at current market value. A confirmed or even probable theft event triggers an impairment assessment. If a client's wallet has been drained and recovery is uncertain, the carrying value of those assets must be written down or written off in the relevant reporting period. Waiting for Ledger's investigation to conclude before recognising the exposure is not prudent accounting practice; the obligation arises when the loss becomes probable and measurable, not when it is formally confirmed by a third party.

For CFOs holding digital assets on the balance sheet through a hardware wallet arrangement, this incident also raises questions about whether the custody model adopted meets the internal control standards set out in audit frameworks. A hardware wallet sourced from a reseller, without independent verification of device integrity, may not satisfy the segregation of duties and physical security controls that auditors expect around significant asset holdings.

Insurance and recovery considerations

Most commercial crime and cyber-insurance policies in the region carry specific exclusions or sublimits for digital asset theft, particularly where the loss arises from a physical supply chain compromise rather than a network intrusion. CFOs should review policy wordings immediately and notify insurers of a potential claim to preserve coverage rights, even before the loss is quantified. Delay in notification is a common basis on which insurers decline crypto theft claims.

Client advisory responsibilities for accounting firms

Firms advising clients who self-custody digital assets across Indonesia, Malaysia and the Philippines should treat this incident as a trigger for a broader custody hygiene review. That means asking clients to confirm where hardware wallets were sourced, whether device integrity was verified on receipt, and whether seed phrases were generated on the device itself or pre-loaded. Any client who purchased from CryptoBilis in the relevant window needs to act on Ledger's advisory now, not after the investigation concludes. Good crypto bookkeeping software or digital asset accounting software practice means keeping records of wallet addresses, acquisition dates, and custody arrangements precisely so that events like this can be responded to quickly.

AML Obligations Triggered by the Incident

The suspected involvement of a supply chain attack, combined with the scale of potential losses, creates layered AML considerations for regulated entities and their advisers in the region.

Suspicious transaction reporting

In Indonesia, Malaysia and the Philippines, regulated crypto service providers and virtual asset service providers (VASPs) are required to file suspicious transaction reports (STRs) where there are reasonable grounds to suspect that assets involved in a transaction are proceeds of crime or are connected to criminal activity. A wallet drain of this magnitude, where funds are moved rapidly to clusters of new addresses across multiple chains, is precisely the pattern that STR obligations are designed to capture. Exchanges and custodians that identify inflows from addresses flagged in connection with this incident should assess their reporting obligations without delay. Firms advising VASPs in the region should ensure their AML procedures address how supply chain compromise scenarios are handled, since many existing typologies focus on phishing or social engineering rather than hardware tampering.

Travel Rule implications

All three jurisdictions have adopted or are implementing FATF's Travel Rule for virtual asset transfers. Transfers originating from compromised wallets to other VASPs will require originator and beneficiary information to be passed along with the transaction. If a VASP receives funds from an address later identified as associated with this incident and cannot establish the originator's identity, it faces both a compliance gap and potential liability. The speed at which Ledger and onchain researchers publicise implicated address lists will determine how quickly exchanges can update their screening systems.

Cross-border coordination risk

Funds traced across Bitcoin, Ethereum and Tron suggest the suspected perpetrators are dispersing assets across chains and likely across jurisdictions. This makes recovery difficult and highlights the cross-border coordination challenge that regulators in Southeast Asia face. Accounting firms supporting clients in AML investigations should be prepared to assist with transaction tracing documentation and to engage with regulators across multiple jurisdictions. For context on how enforcement actions can freeze digital asset balances with little warning, see our earlier coverage of how enforcement actions can freeze digital asset balances with little warning.

Supply Chain Risk and the Limits of Self-Custody

Hardware wallets are marketed on the premise that private keys never leave the device. That premise depends entirely on the integrity of the device as manufactured and delivered. A supply chain attack, where a device is intercepted, modified or counterfeited before it reaches the buyer, undermines the core security model at its foundation. This is not a hypothetical risk: researchers have documented hardware-level tampering in other contexts, and the request for circuit board photographs in this investigation suggests that physical modification is a live hypothesis.

For institutional clients and CFOs, the lesson is that hardware wallet sourcing should be treated with the same due diligence applied to any critical financial infrastructure vendor. Purchasing only from verified, direct channels, inspecting packaging integrity on receipt, and verifying device authenticity through manufacturer tools are baseline controls. Reseller arrangements add a link to the chain of custody, and that link needs to be assessed as part of any digital asset custody policy.

Accounting firms that advise clients on digital asset accounting software and custody frameworks should also review whether their engagement letters and management representation letters address custody risk adequately. If a client holds material digital assets in self-custody and the firm has not documented the custody arrangement and its associated risks, that gap could become significant in the context of an audit or a subsequent loss event.

Practical steps for firms right now

There are several actions that accounting firms and CFOs in Indonesia, Malaysia and the Philippines can take immediately. First, identify any clients or entities that hold Ledger hardware wallets and determine whether those devices were sourced from CryptoBilis or any reseller arrangement in the region. Second, advise affected clients to follow Ledger's official guidance: do not set up any unpaired device and migrate assets from any device already configured. Third, assess whether any digital assets held on potentially compromised devices need to be reflected as impaired or at-risk in current financial statements. Fourth, review AML procedures to ensure that wallet addresses connected to this incident can be screened quickly once a confirmed list is published. Fifth, notify insurers if clients hold cyber or crime policies that might respond to digital asset theft.

For further background on identifying and escalating AML red flags in wallet compromise scenarios, see our detailed coverage of AML red flags compliance teams must know when wallets are compromised.

Frequently Asked Questions

What is CryptoBilis and why does it matter that it was an authorised reseller?

CryptoBilis was listed by Ledger as an official authorised reseller in Indonesia, Malaysia and the Philippines. Authorised reseller status implies that buyers have gone through a legitimate channel and can expect genuine, unmodified hardware. If the suspected supply chain attack is confirmed, it would mean that even buyers acting in good faith through an approved channel received potentially compromised devices, which is a significant failure of the vendor oversight model.

Should clients move assets immediately even before the investigation concludes?

Ledger's own guidance is clear: anyone who purchased from CryptoBilis in the past 90 days and has already set up a device should consider migrating assets to a new signer with a freshly generated seed phrase. Waiting for the investigation to conclude before acting increases the window of exposure. The precautionary step costs little if the device turns out to be unaffected; the cost of inaction if it is compromised could be total loss of the assets held.

How should a CFO account for digital assets that may have been stolen but where loss is not yet confirmed?

Under most frameworks, including IFRS, a loss provision is recognised when it is probable that an outflow of economic benefits will occur and the amount can be estimated reliably. A plausible supply chain attack affecting devices known to be in the entity's custody, where assets are no longer accessible, would generally meet the probability threshold even before formal confirmation. CFOs should work with their auditors to assess the appropriate accounting treatment and disclosure for the current reporting period.

Do exchanges need to do anything if they receive funds from potentially compromised wallets?

Yes. VASPs operating in Indonesia, Malaysia and the Philippines should screen incoming transactions against any address lists published in connection with this incident. Where there are reasonable grounds to suspect that received funds are connected to criminal activity, an STR should be filed with the relevant financial intelligence unit. Exchange compliance teams should also ensure that any Travel Rule data associated with suspicious transfers is preserved for potential regulatory requests.

Is this incident relevant to firms outside Southeast Asia?

The reseller operated across Indonesia, Malaysia and the Philippines, but the suspected theft addresses span Bitcoin, Ethereum and Tron, meaning funds may already have moved to wallets or exchanges in other jurisdictions. Any firm or exchange globally that identifies inflows from implicated addresses has potential AML reporting obligations under its local framework. The cross-border nature of the suspected attack is precisely why Changpeng Zhao called on the entire industry, not just regional players, to assist with tracing and recovery.

Source: The Block