Blockchain analytics firms estimate that attackers siphoned between $93.2 million and $94.5 million from hundreds of wallets associated with Ledger hardware sold through the authorized reseller CryptoBilis. The stolen assets were primarily USDT and TRON tokens, moved across six to seven blockchains depending on the analyst. One report counted 315 compromised wallets, another identified 521 addresses.
How the exploit unfolded
Ledger confirmed the presence of an unauthorised hardware implant in at least one device, though it has not disclosed whether the same method was used across all affected units. Unlike phishing attacks that harvest recovery phrases, this implant apparently gave the perpetrators direct access to private keys, enabling them to empty the wallets outright.
Tether’s intervention and on-chain tracing
Stablecoin issuer Tether acted to freeze $10 million worth of USDT linked to the illicit transfers, a capability not available for Bitcoin or Ether. Analysts from Bitquery noted that, as of 11 October, approximately $81 million of the stolen funds could still be followed on the blockchain, with some transactions routed through privacy-enhancing services such as Tornado Cash and Zcash.
Ledger’s response to customers
The company has urged CryptoBilis users who have not yet activated a device to refrain from doing so. Those who have already used a compromised unit are instructed to move all assets to a fresh Ledger device and generate a new recovery phrase. Ledger has not confirmed the total loss figure nor indicated whether it will offer compensation.
Community reaction
Some observers argue that the incident reflects a broader Ledger responsibility, given CryptoBilis was listed as an authorised reseller on Ledger’s website. Critics contend the breach should be framed as a Ledger-wide issue rather than isolated to a single reseller.
Why it matters
The episode highlights the vulnerability of hardware wallets when supply-chain integrity is compromised, underscoring the need for rigorous device verification. It also demonstrates the growing role of stablecoin issuers in blocking illicit funds, a tool that could shape future remediation efforts after crypto thefts.
