From CoinDesk · By Olivier Acuna
Blockchain analytics firms estimate that attackers stole as much as $94.5 million from hundreds of wallets linked to Ledger devices sold by authorized reseller CryptoBilis, though Ledger has not confirmed the total.
Ledger found an unauthorized hardware implant in at least one affected device, while Tether froze $10 million in USDT tied to the theft and investigators continued tracing the funds.
Ledger advised CryptoBilis customers not to set up unused devices and urged those already using one to transfer their assets to a new device with a newly generated recovery phrase.
As much as $93.2 million in crypto was siphoned from wallets linked to the Ledger devices sold by the reseller CryptoBilis, according to several blockchain analytical and intelligence firms.
Tether has frozen $10 million in USDT tied to the theft, while Ledger said Sunday that the investigations into the theft, first reported three days ago, are still underway.
Ledger confirmed an unauthorized hardware implant in at least one affected device. The company did not say whether the stolen wallet was compromised in the same way or how the devices were tampered with.
Blockchain analysis and intelligence company Bitquery said it traced $93.2 million linked to the Ledger exploit. It said the hackers stole mostly USDT and TRON tokens from 315 wallets across six blockchains. Security research platform YFarmX reported a higher number, saying the attackers siphoned off $94.5 million from 521 addresses across seven blockchains. Both estimates are based on public blockchain data, not a confirmed Ledger loss total.
Ledger did not immediately respond to a CoinDesk request for confirmation of the amount stolen and whether it is considering a reimbursement plan for those affected by the exploit.
The Tether freeze, confirmed by Bitquery, is important because stablecoin issuers can block tokens linked to crime, unlike bitcoin or ether. Bitquery also said roughly $81 million could still be traced onchain as of Oct. 11, while some funds had moved through Tornado Cash and Zcash.
Tether did not immediately respond to a CoinDesk request for comment on the freeze.
Ledger’s effort to characterize the incident as confined to CryptoBilis has drawn pushback because the reseller was listed as authorized on Ledger’s website. “It’s not a CryptoBilis incident, it’s a Ledger incident,” X user MyCryptoParadise wrote. “At least take ownership of this mess.”
The episode is distinct from an April phishing campaign involving a fake Ledger Live app on Apple’s App Store, which drained at least $9.5 million after users entered their recovery phrases. This time, the attacker appears to have obtained the keys needed to directly empty hundreds of wallets.