CryptoBilis Ledger Scam Steals $95M, Singapore Warns of Tampered Wallets

Key Insights:

• The CryptoBilis Ledger crypto scam resulted in $95.35 million in losses across 1,486 addresses, with $30.44 million remaining in tagged wallets.
• Arkham traced stolen funds across Tron, Ethereum, Bitcoin, and cross-chain bridges, while Tether froze $10 million in USDT.
• Singapore police reported tampered Ledger hardware wallets linked to at least two cases and $2.7 million in losses.

CryptoBilis Ledger drainer stole $95.35 million from 1,486 addresses in the latest crypto scam event. This news comes as Singapore police reported separate cases involving tampered Ledger hardware wallets. The incidents highlight growing risks to cryptocurrency holders.

The CryptoBilis Ledger drainer stole $95.35 million from 1,486 cryptocurrency addresses between October 7 and 9, according to Arkham. Most of the theft occurred on October 9, when the attacker stole $80.60 million in 51 minutes.

At 05:07:48 UTC, the main wave of transactions began. By 05:58 UTC, the attacker had received $58.19 million in USDT through 335 transfers on the Tron network. At 05:54 UTC, another major movement involved 203.26 BTC, worth approximately $16.73 million. The Bitcoin came from 112 addresses in a single block, Arkham reported.

The activity continued later that day, with another $14.14 million in USDT arriving on Tron by 15:00 UTC. However, the theft had started earlier, as 7.41 BTC worth about $610,000 arrived from 137 addresses between October 7 and 8.

Following the theft, at least $69.19 million was swapped or moved through cross-chain bridges. The attacker exchanged $20.37 million in USDT on Tron for USDD and transferred another $20 million in USDT to Ethereum through USDT0.

Additional transfers involved USDT and USDC on Tron, BNB Chain, and Polygon. Arkham traced $8.95 million through Relay, $5.91 million through Chainflip, and another $13.96 million through smaller routes.

The attacker also received 10,424 ETH worth approximately $26.04 million through bridging activity. On October 9, linked Ethereum wallets received 5,895 ETH from bridges, then swapped $11.30 million in bridged USDT for 4,530 ETH through Rizzolver.

Despite the movement of funds, Arkham reported that the CryptoBilis drainer still held $30.44 million in tagged wallets. The remaining assets included 4,932 ETH, worth $11.49 million, and 111.28 BTC, valued at $8.96 million. The wallets also contained 10,000,010 USDT on Tron. Tether froze these funds on October 9, according to Arkham.

Arkham further reported that $13.84 million moved during the 48 hours before its update. This indicates that activity linked to the theft continued after the initial attack.

The movement of stolen assets across several networks has made tracking them an ongoing task. Arkham also raised the possibility that the remaining $11.49 million in ETH could follow other deposits into Tornado Cash. However, the available information does not confirm that these funds have entered the service.

The case remains unresolved in the information provided. The reported freeze covers $10 million in USDT, while the other assets remain part of the tracked holdings.

Separately, Singapore police warned on October 28 that some Ledger cryptocurrency hardware wallets purchased from local retailers contained malicious hardware components.

The Singapore Police Force said the components could capture users’ recovery phrases or private keys. This could allow unauthorized persons to access cryptocurrency wallets and transfer assets without the owners’ knowledge or consent.

Since September 10, at least two cases have been reported, with total losses of approximately S$3.5 million, equivalent to about $2.7 million. Ledger, the French hardware wallet manufacturer, is reviewing the affected cases. Police investigations remain ongoing, and the authorities have not established a connection between these incidents and the CryptoBilis drainer.

The police advised cryptocurrency users to follow official security notices from their hardware wallet providers. They also warned users against entering recovery phrases or conducting further transactions through devices suspected of being tampered with.

Anyone who suspects their recovery phrases or private keys have been compromised should consider moving remaining assets to a new, trusted wallet. This should involve an uncompromised device and a newly generated recovery phrase.

The authorities also stressed that users must never share private keys or recovery phrases, including with people claiming to represent wallet providers, exchanges, or law enforcement agencies.

The post Crypto Scam: CryptoBilis Ledger Exploit Tops $95 Million as Singapore Reports Tampered Wallets appeared first on The Coin Republic.