As much as $93.2 million in crypto was siphoned from wallets linked to Ledger devices sold by Southeast Asian reseller CryptoBilis. Blockchain analytical firm Bitquery traced the theft across 315 wallets spanning six blockchains, with USDT and TRON tokens as primary targets. Security research platform YFarmX identified a higher figure—$94.5 million from 521 addresses across seven blockchains—though both estimates rely on public blockchain data.
Tether froze $10 million in USDT tied to the theft. The move underscores a critical advantage stablecoin issuers hold over decentralized assets: the ability to blacklist and freeze tokens associated with criminal activity—a power unavailable for bitcoin or ether.
Ledger confirmed an unauthorized hardware implant in at least one affected device. The company said investigations into the incident, first reported three days ago, remain ongoing.
The attacker obtained private keys needed to directly drain hundreds of wallets, a different attack vector than the April phishing campaign where a counterfeit Ledger Live app on Apple's App Store compromised $9.5 million after users entered recovery phrases.
Ledger characterized the breach as confined to CryptoBilis, but pushback came swift. X user MyCryptoParadise wrote, "It's not a CryptoBilis incident, it's a Ledger incident. At least take ownership of this mess." CryptoBilis was listed as an authorized reseller on Ledger's official website.
Ledger advised CryptoBilis customers not to set up unused devices. For those who already used an affected device, the company recommended moving assets to a new device with a newly generated recovery phrase.
Bitquery data showed roughly $81 million still traceable on-chain as of Oct. 11. Some stolen funds moved through privacy protocols like Tornado Cash and Zcash, complicating recovery efforts.
Ledger has not disclosed the total amount stolen, confirmed whether additional devices were compromised, or announced any reimbursement plan for affected users. Tether did not immediately comment on the freeze.
