CZ Questions Claims Surrounding Ledger Wallet Draining Incident

Binance co-founder Changpeng Zhao, known as CZ, has questioned the circumstances surrounding the Ledger wallet draining incident, which has been linked to hardware wallets sold through Southeast Asian reseller CryptoBilis.

The incident came to light on October 9, 2026, after users reported losing cryptocurrency from their wallets. Blockchain researchers have estimated the losses at between $86 million and $93 million across more than 300 wallets, although Ledger has not confirmed the total.Ledger has since confirmed that at least one affected device contained an unauthorised hardware implant. The company says all confirmed cases linked to the October 9 incident involve devices sold through CryptoBilis.

CZ Questions CryptoBilis Ownership and Acquisition

CZ has raised concerns about CryptoBilis following reports that the reseller changed ownership earlier in 2026. In a post on X, the Binance co-founder alleged that the attackers had apparently purchased the reseller and required its operators to sign a non-disclosure agreement (NDA).

His comments have drawn attention to the relationship between the reseller’s ownership change and the reported cryptocurrency thefts. However, the allegation that the buyers were connected to the attackers remains unverified. Although former CryptoBilis executives have acknowledged the ownership transfer and the existence of confidentiality provisions, no publicly verified evidence has established that the acquisition facilitated the incident. The distinction is important because an ownership change, on its own, does not prove involvement in a criminal operation.

Ledger Confirms Unauthorised Hardware Implant

Ledger initially announced an investigation after receiving reports of cryptocurrency losses involving customers who purchased devices through CryptoBilis. As a precaution, the company asked the reseller to suspend sales and shipments while the investigation continued. On October 10, Ledger confirmed that an affected device contained an unauthorised hardware implant.

In a subsequent update on October 11, the company said all confirmed cases associated with the October 9 incident involved devices sold through CryptoBilis. Ledger also stated that its internal systems and direct sales channels remained unaffected. The company is working with relevant authorities and contacting affected customers as investigations continue.

The hardware implant confirmation has strengthened concerns about possible supply-chain tampering. However, investigators have not established that the same mechanism explains every reported wallet loss. Hardware wallets are designed to protect cryptocurrency private keys by keeping them isolated from internet-connected devices.

Nevertheless, a compromised device could undermine that protection if malicious hardware captures sensitive information during setup. For this reason, the incident raises questions about how hardware wallets are sourced, distributed and checked for tampering before reaching customers.

CryptoBilis Customers Receive Security Warning

Ledger has advised customers who purchased devices through CryptoBilis to take precautions while the investigation continues. Customers who have not yet set up their devices should not initialise them. Those who have already configured potentially affected devices should consider moving their assets to a trusted Ledger device using a newly generated recovery phrase, following the company’s official guidance.

The company has also urged affected customers to contact official Ledger Support and report the incident to local law enforcement where appropriate. Meanwhile, Ledger has warned users to remain alert to impersonation attempts. Scammers may exploit the incident to contact victims with fake recovery services or requests for sensitive information. Ledger will never ask users to disclose their 24-word secret recovery phrase. Anyone receiving such a request should treat it as suspicious.

You may also like: CZ Shares Shirtless Gym Photo at 49, Says Health Matters More Than Wealth

Editorial Takeaway

The incident highlights the risks that can arise when cryptocurrency security depends on more than the technology inside a device. Although hardware wallets can protect private keys from many online threats, users also depend on the integrity of the devices they purchase and the supply chains through which those products reach them.

CZ’s allegations have introduced further questions about CryptoBilis’ ownership change. However, investigators have yet to establish a connection between the acquisition and the reported thefts. The total losses, the number of affected devices and the identities of those responsible also remain unconfirmed. For now, the confirmed hardware implant and the reported wallet drains are central to the investigation, while claims about the attackers’ identities and motives require further evidence.