Ledger users in Southeast Asia who bought hardware wallets from the reseller CryptoBilis had set up their devices to hold cryptocurrency. On 9 October, independent investigators began detecting unusual outflows from hundreds of those wallets across the Bitcoin, Ethereum and TRON blockchains.
The episode is best read as a problem in distribution as much as in digital security: the available evidence points to customers who bought through one reseller, while the route by which their wallets were drained remains unresolved. Ledger said it was investigating reports of stolen funds from customers in Southeast Asia who had bought devices through CryptoBilis.
Specter, an on-chain investigator, traced money flowing from hundreds of victim wallets into 98 receiving addresses and estimated the losses at $86.96 million. Another researcher, tanuki42, had earlier put losses above $72 million and said the figure was rising.
The receiving addresses should not be treated as a victim count. Specter’s work traced inflows from hundreds of wallets, while the 98 addresses were destinations for the funds. In a 9 October post on X, Specter said the reported Ledger wallet drains exceeded $86 million.
Other estimates were higher. Bitquery put the stolen funds at $92.9 million and said Tether had frozen approximately $10 million in 20 wallets. Arkham data cited by Specter showed the theft addresses holding roughly $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT. Specter said 10 of the theft addresses held only over $25 million at the last check.
The attackers also moved quickly when part of the stolen money was still in USDT. Between 7:26am and 7:32am ET on 9 October, funds linked to the thefts were converted from 2 million USDT into USDD through four transactions via USDD’s peg stability module. The transactions came before Tether’s wider blacklist actions at about 8:09am ET.
That timing mattered because a USDT freeze can stop the token from moving, while that control does not apply to USDD. The conversion was described as an effort to evade Tether’s freeze controls.
Ledger Support asked CryptoBilis to pause all sales and shipments of Ledger devices. It told customers who had bought from the reseller during the last 90 days and had yet to set up their device not to do so. Customers who had already set up a device were advised to move their funds to a new device with a brand new recovery phrase.
CryptoBilis is a Malaysian shop founded in 2020 that sells Ledger hardware and operates in Indonesia and the Philippines. Changpeng Zhao, the founder of Binance, said the incident appeared localised to a supply chain attack and urged Ledger users to remain vigilant.
Ledger has not confirmed that assessment, said whether devices were tampered with, or identified the method used to drain the wallets. It has also not endorsed the $86 million figure, which comes from independent investigators.
Earlier this year, a researcher found counterfeit Ledger units on a Chinese marketplace that sent a buyer’s PIN and recovery phrase directly to attackers. That finding does not establish what happened in the CryptoBilis case, where the number of people affected, the point at which devices or wallets may have been compromised, and whether any other resellers were affected remain unknown.
Comments (0)