Ledger issued a 72-hour update on the CryptoBilis reseller incident in a post on X, saying it is working with relevant authorities as the investigation continues and that the volume of impacted devices is limited; it is reaching out to impacted users. To date, all confirmed cases tied to the Oct. 9, 2026 draining incident involve devices sold through Southeast Asia reseller CryptoBilis, and Ledger's systems and direct sales channels remain unaffected; the company said it is actively investigating.

Ledger encouraged impacted users to contact Ledger Support through official channels and file complaints with their local law enforcement authorities, noting CryptoBilis has confirmed it ceased all hardware wallet sales. The company said it is reminding authorized resellers and distributors to source products only through authorized channels and never restock returned products, and advises users not to buy from unauthorized resellers, where devices may be suspicious, counterfeit or modified and operate outside Ledger's security guidelines. Ledger also said it is reviewing authorized reseller controls, advancing hardware protections and cooperating with authorities, with SEAL_911 providing collaborative support on the investigation.

Ledger described the incident as an ongoing threat that affects the entire ecosystem, not just itself, and called on others in the space to work together on chain-of-custody practices and anti-tamper techniques; anyone with relevant information was asked to contact security@ledger.com. For CryptoBilis buyers: do not initialize unused devices; if already set up, move to a new seed on a Ledger device. Users concerned their device was impacted should contact Ledger Support through the official site, support.ledger.com, available 24/7. Ledger added that users should rely only on its official channels, as it will never call, DM, or ask for a 24-word recovery phrase.