Ledger investigates CryptoBillis after reports of lost funds

Ledger Support said on October 9, 2026, that it is investigating reports of lost funds from users in South East Asia who bought devices from a reseller named CryptoBillis. The same post then spells the seller CryptoBilis, and says Ledger has asked that seller to pause every sale and shipment of Ledger devices while the investigation is open. The post is here:

A reseller, in this notice, is not Ledger. It is a shop that sold the hardware. The instruction is aimed at people who bought from that shop in the last 90 days. Ledger has not published a dollar total, a count of wallets, or a finished account of how the funds moved. What it has published is the pause, the region, and the window.

The setup line is the one a buyer can use today. If the device from this reseller has not been turned on, Ledger says not to start that setup. Setup is the moment a new wallet creates its recovery phrase and starts holding coins. Leaving the device unset keeps that step from happening on hardware the company is still looking at.

The second line is for people who already set one up. Ledger says they should consider moving the assets to a new Ledger signer, and that the new signer should use a new seed. A seed is the recovery phrase that controls the coins. A new phrase means the coins no longer depend on the one created on the device under review. The post says consider. It does not say every device from the shop has failed.

A signer is the device that approves the transaction. Ledger's wording is specific: a new Ledger signer, not the old recovery phrase copied onto a second device. The new seed is what makes the move a move. Carrying the old phrase over would leave the same control of the coins, which is not the precaution the post described.

The spelling is part of the record. The first sentence says CryptoBillis. The sentence about the sales pause says CryptoBilis. Both are in the official post, so a search for either string is the same seller. Ledger did not attach a website, a company number, or a single country inside the region. South East Asia is the place it named. The 90 days run back from October 9.

Ledger said it will keep customers informed as the investigation progresses, and it told readers to take questions to Ledger customer support through official channels. The support account's profile carries a standing line that belongs next to a post like this: Ledger will not ask for the 24-word recovery phrase, and it will not ask in a direct message or on a phone call. A message that asks for those words is not this investigation.

This notice is separate from the product Ledger introduced earlier in the week. Crypto Loan lets an eligible user borrow against bitcoin through a signer, and that is a different announcement. The reseller pause does not change that product, and the loan does not explain these reports. That story is here: https://cryptokeymedia.com/news/ledger-crypto-loan

What comes next is the update Ledger said it would publish. The investigation is open. Sales and shipments from the named reseller are paused. Buyers in the 90-day window have two instructions, and which one applies depends on whether the device has been set up. Until that update lands, those are the facts the support account has put on the record.