A review of Ledger's historical security incidents shows fake apps once caused $9.5 million in stolen funds, and today's situation remains under scrutiny.

Ledger Investigates CryptoBilis Channel After Third-Party Estimate of $90,000,000 Loss

BlockBeats reported on Oct 9, 2026 that hardware wallet maker Ledger is facing another security incident. A third-party security firm estimated the losses from the latest event at about $90,000,000. Ledger said it is investigating financial losses linked to devices sold by CryptoBilis, an authorized distributor in Southeast Asia. The company asked CryptoBilis to halt sales and shipments and advised users who bought from that channel in the past 90 days to operate cautiously or move assets. The cause has not been finally confirmed, but the incident is suspected to involve supply-chain or device-tampering risk.

A distributor-linked investigation turns attention to device integrity

The Oct 9, 2026 case is different from earlier incidents because the suspected exposure is tied to a sales channel rather than only a software update, a public data leak, or a fake interface. Hardware wallets are generally trusted because private keys stay on the device and transactions are confirmed by the user's screen. If a device is altered before it reaches a buyer, the user may face risk even without revealing a secret phrase or approving a malicious transaction.

Ledger has not confirmed the final cause, so the investigation's scope remains important. The 90-day purchase window gives recent buyers a practical point of comparison: the risk, if confirmed, appears concentrated around devices obtained through CryptoBilis rather than all Ledger products sold worldwide.

The 2026 incidents: order data, fake app, signature bugs

The latest event follows a series of 2026 security-related incidents.

In Jan 2026, third-party Global-e order data was exposed. The payment logistics partner's system was accessed without authorization, and some Ledger.com order information, including names, addresses, and contact details, was leaked. Ledger said its own systems and private keys were not affected. The breach still raised phishing risk because attackers could use real order details to make fake communications appear credible.

In Apr 2026, a counterfeit Ledger Live app appeared in the App Store. The fake app was listed for about one week and tricked users into entering their mnemonic phrases. More than 50 victims lost about $9,500,000 across multiple chains. Apple later removed the app, and Ledger again said it never asks users for a 24-word mnemonic phrase.

In Aug 2026, Ledger disclosed Ethereum app signature vulnerabilities, including identifiers such as LSB-023. The issues included command interlacing that could cause the displayed information and the signing parameters to be out of sync, as well as Clear-signing bypass problems. Ledger said exploitation required a malicious host and there was no evidence that actual users had been attacked. The company said the problems were fixed in new versions.

The Oct 9, 2026 CryptoBilis incident is the latest and, by the third-party estimate, the largest in this list: the estimated $90,000,000 loss is above the Apr 2026 fake-app case's estimated $9,500,000.

Earlier vulnerabilities and data exposure

Ledger's earlier security history also shows a mix of hardware research, data leaks, and software supply-chain attacks.

In 2018, early hardware and supply-chain research vulnerabilities were demonstrated together. Security researchers showed possible pre-shipment tampering of the Nano S, microcontroller bootloader bypass, isolation vulnerabilities, and Bitcoin change address injection. Ledger released advisories and fixes over time. Many of those issues were research-level or required physical contact with the device.

In 2020, a large customer data breach exposed personal data rather than keys. Attackers used third-party API keys and Shopify-related vulnerabilities to obtain e-commerce and marketing databases. More than 1 million email addresses and about 272,000-292,000 customer records, including names, addresses, and phone numbers, were made public. The hardware devices and private keys were not affected. The leak, however, fed long-term phishing, social engineering, and fake official letter scams.

In Dec 2023, the Ledger Connect Kit supply-chain attack showed how a dependency could be poisoned. A former employee was phished and the person's NPMJS account was controlled. The attacker published a malicious Connect Kit version, which was injected into decentralized applications that depended on the library, causing users to sign transactions that drained funds. The active window lasted about 2 hours, and losses were estimated at about $480,000-$600,000. The hardware devices and Ledger Live itself were not directly compromised.

What the latest incident changes for users

For readers, the value of the chronology is in the pattern. Ledger's past incidents have moved between research-level hardware flaws, customer data exposure, malicious software libraries, third-party order data leaks, fake apps, signature display risks, and now a distributor-linked wallet drain estimate. The key distinction is that not every incident compromises private keys directly. Some incidents create conditions for scams, while others affect device integrity before use.

The next facts to watch are the confirmed cause of the CryptoBilis-linked losses, whether the issue is limited to devices sold through that channel, and whether users receive clear guidance on identifying affected hardware. Until Ledger confirms the mechanism, the most concrete public detail remains the third-party estimate of about $90,000,000 and the company's request to pause CryptoBilis sales and shipments.