Mentioned in This Article
1. Ledger CryptoBilis losses climb past $90 million
Blockchain analytics firms say between roughly $93 million and $94.5 million has been drained from wallets set up on Ledger hardware devices sold by CryptoBilis, a Southeast Asian reseller. Tether has frozen $10 million of USDT linked to the thefts, and Ledger said on Sunday, October 11, that its investigation is still under way. The scale of the losses has grown since the incident first surfaced.
The case was first reported three days earlier, when the losses stood at about $86 million. The newer figures come from analytics firms tracing public blockchain data rather than from a total confirmed by Ledger, which has not published its own number.
Ledger has stressed that every confirmed case involves devices sold through CryptoBilis, a position that has drawn criticism because the reseller is listed as an authorized seller of Ledger hardware.
2. What did Ledger confirm about the tampered devices?
Ledger confirmed that it found an unauthorized hardware implant in at least one of the affected devices. A hardware implant is an unwanted component or modification added to a device, in this case before it reached the customer, and it can allow an attacker to capture the secrets that protect a wallet.
The company did not say whether the wallets that were emptied were compromised in the same way, and it did not explain how the devices were tampered with. Those are central questions, because the answer determines how many customers are at risk and at what point in the supply chain the interference took place.
Ledger did not immediately respond to questions about the total amount confirmed to be stolen or about whether it would offer any reimbursement to victims.
3. How much has been stolen, according to the analytics firms?
Two firms have published estimates. Bitquery traced $93.2 million, mostly in USDT and tokens on the TRON network, taken from 315 wallets across six blockchains. YFarmX reported $94.5 million from 521 addresses across seven blockchains.
The difference is small compared with the totals, and it reflects different methods of identifying which addresses belong to the same campaign. Both figures rest on public blockchain data, which means they are estimates of funds that moved out of linked wallets rather than amounts verified by the hardware maker or by victims.
The spread across many wallets and several networks is itself informative. It suggests that the attacker did not exploit a single account but gained the ability to empty hundreds of wallets directly, which fits the pattern of an attacker who obtained the keys needed to control them.
4. Why did Tether freeze $10 million?
Tether froze $10 million in USDT connected to the thefts. Bitquery confirmed the freeze. Stablecoin issuers can block specific tokens held at specific addresses, a power that does not exist for bitcoin or ether, and that ability is why a stablecoin theft can sometimes be partly reversed in practice.
The frozen amount is roughly a tenth of the estimated total. Bitquery estimated that about $81 million remained traceable as of October 11, but it also found that some of the funds had passed through Tornado Cash and Zcash, two systems designed to obscure the movement of money. Funds routed through privacy tools are harder to follow and more difficult to freeze.
Tether did not immediately comment on the freeze. Tracing is continuing, and any further freezes would depend on stolen funds landing at addresses that the issuer can reach before they are moved into assets it cannot control.
5. Is this a Ledger problem or only a reseller problem?
Ledger has framed the incident as limited to devices sold by CryptoBilis, and it says every confirmed case involves that reseller. That framing is meant to reassure the wider customer base that devices bought elsewhere are not implicated.
The framing has been challenged. Ledger's own website lists CryptoBilis as an authorized reseller, and a critic on social media argued that the episode should be seen as a Ledger incident for which the company ought to take responsibility. The argument is that a manufacturer that endorses a sales channel bears some accountability for what that channel delivers to buyers.
The dispute turns on where the compromise occurred. If the tampering happened inside the reseller's channel, the manufacturer can argue that its own production was unaffected. If it affected devices that customers reasonably believed were genuine Ledger products bought from an approved source, many users will still see the brand as responsible. Ledger has not yet explained how the implants entered the devices, so the question remains open.
6. How is this different from the April phishing campaign?
The incident differs from an April phishing campaign, in which a fake Ledger Live application on Apple's App Store drained at least $9.5 million after users typed their recovery phrases into it. In that case, victims handed over their secrets themselves, believing they were using an official app.
In the CryptoBilis case, the attacker appears to have obtained the keys needed to empty hundreds of wallets directly, without victims entering their phrases anywhere. That points to a problem with the devices themselves, which is a more serious concern for a company whose business rests on the claim that keys never leave the hardware.
The scale also differs. The April campaign involved at least $9.5 million, while the current estimates are about ten times higher.
7. How does a hardware wallet protect crypto, and where can it fail?
A hardware wallet is a small dedicated device that stores the private keys controlling a person's crypto and signs transactions internally, so that the keys never touch an internet-connected computer. When a user first sets one up, the device generates a recovery phrase, a list of words that can restore the wallet if the device is lost. Anyone who learns that phrase, or the keys it produces, can move the funds.
That design means the security of the device depends on the integrity of the hardware and software from the factory to the user. If a device has been altered before it is switched on, for example by an added component, the protections that the owner relies on may not operate as intended. This kind of tampering is often described as a supply chain attack, because it targets the path the product takes to the customer rather than the customer directly.
Ledger's confirmation of an implant in at least one device places this case in that category. The open question is how many devices were modified and whether the stolen funds came from wallets set up on them, since the company has not said that the drained wallets were compromised through the same method.
8. What does the frozen Tether show about tracing stolen funds?
The $10 million freeze illustrates a feature that distinguishes stablecoins from decentralized cryptocurrencies. The issuer holds the technical ability to blacklist an address, which stops the tokens there from being transferred. Law enforcement and security firms frequently ask issuers to use that power after thefts, and the speed of the request often determines how much can be recovered.
Thieves know this and tend to move stablecoins quickly into other assets or through services that obscure the trail. Bitquery found that part of the stolen money had passed through Tornado Cash, a mixing protocol on Ethereum, and Zcash, a cryptocurrency that supports shielded transactions. Once funds enter such systems, analysts can no longer follow them with the same confidence, and the chance of freezing them falls.
The roughly $81 million that Bitquery said remained traceable as of October 11 therefore represents the window in which further action is possible. How much of it can be frozen will depend on how fast investigators, the analytics firms and Tether coordinate, and on where the attacker chooses to send the money next.
9. What should owners of CryptoBilis devices do?
Ledger told CryptoBilis customers who have not yet set up their devices not to do so. For anyone who has already used a device bought from the reseller, the company advised moving assets to a new device with a newly generated recovery phrase.
The reasoning is straightforward. If an implant or a pre-generated secret exists on a device, any funds placed there remain exposed, and the recovery phrase created on it cannot be trusted. A fresh device from a verified source and a new phrase create a new set of keys that the attacker does not hold.
Ledger has not yet published a total for confirmed losses, a reimbursement plan or an explanation of how the devices were tampered with. Ledger's current guidance is limited to customers of CryptoBilis.
10. What happens next in the investigation?
Ledger's investigation continues, and the next developments to watch are a confirmed loss figure, an explanation of how devices were modified and any decision on compensation. Tracing of the stolen funds is also ongoing, with analytics firms following the roughly $81 million that Bitquery estimated remained traceable and with Tether positioned to freeze any additional USDT that reaches addresses within its reach.
The outcome will matter beyond this case. If investigators establish that the compromise took place in the reseller's channel, hardware makers may face pressure to tighten oversight of authorized sellers. If the implant traces back to earlier stages of manufacturing or shipping, the questions for Ledger itself will become much harder to avoid.
For customers, the practical stakes are immediate. Anyone holding assets on a device bought through CryptoBilis has to decide whether to follow Ledger's advice and migrate, while the company and the analytics firms continue to work on establishing the full extent of the losses and the methods used.