Ledger Says CryptoBilis Cases Remain Limited as $93M Is Traced and $10M Frozen

Ledger said all confirmed cases so far involve devices sold through Southeast Asian reseller CryptoBilis. However, critics argue that the hardware-wallet manufacturer must take responsibility because the reseller was listed as an authorized sales channel.

Blockchain analytics and intelligence firms estimate that as much as $93.2 million in cryptocurrency was stolen from wallets associated with Ledger devices purchased through CryptoBilis.

Tether has frozen $10 million in USDT connected to the theft, while Ledger said Sunday that investigations into the incident remain ongoing. The case was first reported three days earlier.

Ledger confirmed that at least one affected device contained an unauthorized hardware implant. However, the company has not disclosed whether the wallet that lost funds was compromised through the same method or explained how the devices were altered.

Bitquery, a blockchain analytics and intelligence firm, said it traced $93.2 million associated with the incident. According to its analysis, attackers took primarily USDT and TRON tokens from 315 wallets across six blockchains. Security research platform YFarmX reported a larger estimate, putting the stolen amount at $94.5 million across 521 addresses on seven blockchains. Both figures are derived from publicly available blockchain data and do not represent a confirmed total loss figure from Ledger.

Ledger did not immediately respond to CoinDesk’s request for confirmation of the amount stolen or whether it plans to compensate affected customers.

Tether Freezes $10 Million in USDT

The $10 million freeze, confirmed by Bitquery, is notable because stablecoin issuers such as Tether can blacklist tokens associated with suspected criminal activity. Bitcoin and ether do not offer the same issuer-controlled freezing mechanism.

Bitquery said approximately $81 million remained traceable onchain as of October 11. Some of the funds had reportedly passed through Tornado Cash and Zcash, complicating efforts to follow their movement.

Tether did not immediately respond to CoinDesk’s request for comment regarding the freeze.

Critics Challenge Ledger’s Response

Ledger’s attempt to frame the incident as limited to CryptoBilis customers has faced criticism because the reseller appeared on Ledger’s website as an authorized seller.

“It’s not a CryptoBilis incident, it’s a Ledger incident,” X user MyCryptoParadise wrote, calling on the company to accept responsibility for the situation.

The latest incident differs from a phishing campaign in April involving a counterfeit Ledger Live application distributed through Apple’s App Store. That campaign reportedly resulted in at least $9.5 million in losses after users entered their recovery phrases into the fraudulent app.

In the CryptoBilis case, the attacker appears to have obtained the cryptographic keys needed to drain hundreds of wallets directly, rather than relying on users to disclose their recovery phrases through a fake application.

Ledger has advised CryptoBilis customers who have not yet activated their devices to avoid setting them up. Customers who have already used an affected device should transfer their assets to a new device and generate a fresh recovery phrase, the company said.

About The Author

ctleditor

See author's posts