CoinDesk
Blockchain analytics firms estimate that attackers siphoned between $93.2 million and $94.5 million from hundreds of wallets linked to Ledger devices sold by authorized Southeast Asian reseller CryptoBilis. Bitquery traced $93.2 million from 315 wallets across six blockchains, while YFarmX reported $94.5 million from 521 addresses across seven networks. Ledger has not confirmed the total loss.
Ledger said every confirmed case involves devices sold by CryptoBilis and confirmed an unauthorized hardware implant in at least one affected device. The company has not said whether the stolen wallets were compromised through the same method, how the devices were tampered with, or whether it will reimburse affected users.
Why it matters
The incident raises a broader supply-chain question because CryptoBilis was listed as an authorized Ledger reseller. Ledger has characterized the cases as limited to that channel, but critics argue that authorization makes oversight part of the hardware-wallet maker's responsibility. The attack also differs from a phishing campaign involving a fake Ledger Live app, since investigators say the latest theft appears to involve keys that directly emptied wallets.
Tether froze $10 million in USDT tied to the theft, while Bitquery said about $81 million remained traceable onchain as of Oct. 11. Some funds moved through Tornado Cash and Zcash. Stablecoin issuers can block identified tokens linked to criminal activity, unlike Bitcoin or Ether.
Market impact
Ledger advised CryptoBilis customers not to set up unused devices. Users who already activated one were told to transfer assets to a new device using a newly generated recovery phrase. That guidance makes device provenance and recovery-phrase hygiene immediate risk controls for affected customers.
The final loss figure, the route used to compromise the devices, and any potential reimbursement remain unresolved. The case will also test how hardware-wallet providers manage authorized distribution networks when a security failure reaches customer funds.
Frequently asked questions
-
How much crypto was stolen from wallets linked to CryptoBilis devices?
Estimates range from $93.2 million traced by Bitquery to $94.5 million reported by YFarmX. Ledger has not confirmed the total loss.
-
What did Ledger confirm about the affected hardware wallets?
Ledger confirmed an unauthorized hardware implant in at least one affected device. It has not said whether the stolen wallets were compromised through the same method.
-
How much of the stolen crypto did Tether freeze?
Tether froze $10 million in USDT tied to the theft. Bitquery said about $81 million remained traceable onchain as of Oct. 11.
-
Why is the CryptoBilis reseller relationship under scrutiny?
CryptoBilis was listed as an authorized Ledger reseller. Critics therefore argue that the incident raises questions about Ledger's oversight of its authorized sales channel.
-
What should CryptoBilis customers do with their Ledger devices?
Ledger advised customers not to set up unused CryptoBilis devices. Users who already activated one should transfer assets to a new device with a newly generated recovery phrase.
CryptoSlate
Lookonchain
CoinTelegraph
WuBlockchain
WatcherGuru
Glassnode
TheBlock