Ledger states that each confirmed case involved devices sold by this Southeast Asian reseller, but critics argue that the hardware wallet manufacturer must be held accountable for its authorized sales channels.
Blockchain analysis firms estimate that attackers stole up to $94.5 million from hundreds of wallets associated with Ledger devices sold through authorized reseller CryptoBilis, though Ledger has not yet confirmed this total.
Ledger found that at least one affected device contained an unauthorized hardware implant; meanwhile, Tether has frozen $10 million in USDT related to the theft, and investigators are continuing to track the flow of funds.
Ledger advises CryptoBilis customers not to set up devices that have not yet been used, and urges users who are already using such devices to transfer their assets to a new device and generate a new recovery phrase.
According to multiple blockchain analysis and intelligence firms, up to $93.2 million in crypto assets have been moved from wallets associated with Ledger devices sold by reseller CryptoBilis.
Tether has frozen $10 million in USDT related to this theft, and Ledger said on Sunday that its investigation into the theft, first reported three days ago, is still ongoing.
Ledger has confirmed that at least one affected device contains an unauthorized hardware implant. The company has not specified whether the compromised wallets were breached in the same manner, nor has it disclosed how these devices were tampered with.
Blockchain analytics and intelligence firm Bitquery reported that it tracked $93.2 million linked to the Ledger exploit. The company stated that hackers primarily stole USDT and TRON tokens from 315 wallets across six blockchains. The security research platform YFarmX provided a higher figure, indicating that attackers transferred $94.5 million from 521 addresses across seven blockchains. Both estimates are based on publicly available on-chain data, not the total loss confirmed by Ledger.
Ledger did not immediately respond to CoinDesk's requests for comment on the confirmation of the stolen amount or whether it is considering compensation for affected users.
Bitquery confirmed that Tether's freeze is significant because, unlike Bitcoin or Ethereum, stablecoin issuers can block tokens associated with criminal activity. Bitquery also stated that, as of October 11, approximately $81 million remained traceable on-chain, while some funds had already been transferred via Tornado Cash and Zcash.
Tether did not immediately respond to CoinDesk's request for comment on the freeze.
Ledger’s attempt to characterize this incident as solely CryptoBilis’s responsibility has been challenged, since the reseller is listed as an authorized channel on Ledger’s website. X user MyCryptoParadise wrote: “This isn’t CryptoBilis’s incident—it’s Ledger’s. At the very least, take responsibility for this mess.”
This incident differs from the phishing campaign in April, which involved a counterfeit Ledger Live app on the Apple App Store, resulting in at least $9.5 million being stolen after users entered their recovery phrases. In this case, the attackers appear to have obtained keys that allow them to directly empty hundreds of wallets.
Ledger advises CryptoBilis customers not to set up devices that have not been used. The company states that users who have already used a device should transfer their assets to a new device and generate a new recovery phrase.