Ledger Ties $87⁠–⁠94M Wallet Drain to Reseller CryptoBilis

Ledger said on Sunday, Oct. 11, that every confirmed case in the recent wallet drains involves devices sold by CryptoBilis, a Southeast Asian reseller. Onchain analysts estimate that between $86 million and $94.5 million has been stolen from wallets on those devices; Ledger itself has not confirmed a total. The company began investigating on Friday, Oct. 9, after buyers in Southeast Asia reported losses. Its update was picked up on Oct. 12 by CoinDesk and Decrypt.

Details

Loss estimates differ. Investigator Specter traced more than $86 million across Ethereum, Tron and Bitcoin. Bitquery traced $93.2 million, mostly in USDT and Tron tokens, across 315 wallets on six blockchains. YFarmX puts the figure at $94.5 million across 521 addresses on seven chains. All of these rest on public blockchain data, and Ledger has not endorsed any of them.

Ledger calls the scale "limited" and confirmed an unauthorized implant in at least one device sold by CryptoBilis. It has not said whether the drained wallets were compromised the same way, or how the devices were tampered with. Ledger says its own systems and direct sales are unaffected, and CryptoBilis has stopped selling hardware wallets. Buyers from the reseller are told not to set up unused devices; those already using one should move funds to a Ledger-purchased device with a new recovery phrase. Ledger reminded users it never asks for the 24-word phrase.

Per Bitquery, Tether froze $10 million of USDT, and about $81 million was still traceable onchain as of Oct. 11, with some funds routed through Tornado Cash and Zcash. YFarmX claims 15 million stolen USDT was swapped into USDD, which Tether cannot freeze, and says it gave Ledger a list of more than 450 drained wallets (not independently verified). Critics note that CryptoBilis was listed as an authorized reseller on Ledger's website and want the company to take responsibility. Ledger has not said whether it will reimburse victims.

What it means for the market

The case hits the core argument for hardware wallets: keys kept offline are only as safe as the device that reaches the buyer. Supply-chain risk is not unique to one brand, and Ledger says it is reviewing reseller controls and asking the industry to agree on anti-tamper practices.

It also shows the limits of freezes. Tether could block $10 million, which neither bitcoin nor ether allows, yet swapping into USDD sidesteps that protection. The investigation is ongoing and the numbers may change; for live market data see the daily summary.