Crypto09 October, 20262 min read
Ledger Investigates $86 Million Crypto Losses After CryptoBilis Reseller Supply-Chain Attack
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Ledger investigates over $86 million stolen from wallets linked to CryptoBilis reseller in Southeast Asia. Ledger halted CryptoBilis sales and warned customers to refrain from activating affected wallets.
Ledger probes $86M drain
Ledger said it is investigating reports of more than $86 million in crypto losses involving customers who purchased its hardware wallets through CryptoBilis, an authorized reseller operating in Southeast Asia. Ledger’s support account confirmed the investigation on Friday and asked CryptoBilis to suspend sales and shipments during the period. Ledger advised customers who purchased devices from CryptoBilis within the past 90 days and have not initialized them to avoid setting them up, and it urged those who already activated wallets to consider moving assets to a new Ledger signer with a new seed.
On-chain investigator Specter initially estimated losses at more than $86 million, while blockchain analytics firm Bitquery estimated that approximately $92.9 million had been stolen from 311 wallets across five networks including Bitcoin, Ethereum, TRON, BNB Chain and Polygon. Changpeng Zhao (CZ) said the incident could involve a localized supply-chain attack, writing, “I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds.”
Tether freezes USDT
Tether froze USDT linked to suspected Ledger wallet thefts, and blockchain investigators said the losses were approaching $90 million. Ledger told customers who bought devices from CryptoBilis in the past 90 days not to initialize them if they had not yet completed setup, and it urged those who had already configured wallets to consider transferring cryptocurrency to a new Ledger device initialized with a fresh recovery phrase. Mark Karpelès said he was investigating whether malicious hardware components were inserted into devices distributed to customers, and he asked CryptoBilis to open some of its unsold Ledger wallets for inspection.
Changpeng Zhao warned users in an X post that “Based on information so far, it seems to be localized to a supply chain attack with one vendor.” MistTrack said it observed Tether freezing USDT linked to the incident, while it also noted that freezing USDT does not automatically return tokens to their original owners.
Supply-chain tampering fears
Specter traced suspected theft addresses across Bitcoin, Ethereum and Tron after seeing reports from Ledger users on X and Reddit, and Ledger acknowledged the reports of missing funds from customers who purchased devices through CryptoBilis. Ledger said it asked CryptoBilis to pause all sales and shipments as a precaution, and it advised recent buyers not to set up their devices while the investigation continues. A Bitcoin holder reported losing 80 BTC worth $5.2 million after moving coins onto a Ledger hardware wallet that was purchased through CryptoBilis, and the transfer happened just one week before the funds disappeared.
Another buyer reported losing 7 million USDT after buying a Ledger device three weeks before the incident, and TradingView said analysts tracked assets flowing to theft addresses across multiple blockchain networks. Mark Karpelès described a tampered-device scenario in which “an extra chip sits inside the casing, reads what appears on the screen, records the seed phrase,” and he said such a device “passes Ledger's genuine check.”