Ledger claims CryptoBilis cases are limited as up to $93M is traced, $10M frozen
Ledger said every confirmed case involves devices sold by the Southeast Asian reseller, but critics say the hardware-wallet maker must answer for an authorized sales channel.
As much as $93.2 million in crypto was siphoned from wallets linked to the Ledger devices sold by the reseller CryptoBilis, according to several blockchain analytical and intelligence firms.
Tether has frozen $10 million in USDT tied to the theft, while Ledger said Sunday that the investigations into the theft, first reported three days ago, are still underway.
Ledger confirmed an unauthorized hardware implant in at least one affected device. The company did not say whether the stolen wallet was compromised in the same way or how the devices were tampered with.
Blockchain analysis and intelligence company Bitquery said it traced $93.2 million linked to the Ledger exploit. It said the hackers stole mostly USDT and TRON tokens from 315 wallets across six blockchains. Security research platform YFarmX reported a higher number, saying the attackers siphoned off $94.5 million from 521 addresses across seven blockchains. Both estimates are based on public blockchain data, not a confirmed Ledger loss total.
Ledger did not immediately respond to a CoinDesk request for confirmation of the amount stolen and whether it is considering a reimbursement plan for those affected by the exploit.
The Tether freeze, confirmed by Bitquery, is important because stablecoin issuers can block tokens linked to crime, unlike bitcoin or ether. Bitquery also said roughly $81 million could still be traced onchain as of Oct. 11, while some funds had moved through Tornado Cash and Zcash.
Tether did not immediately respond to a CoinDesk request for comment on the freeze.
Ledger’s effort to characterize the incident as confined to CryptoBilis has drawn pushback because the reseller was listed as authorized on Ledger’s website. “It’s not a CryptoBilis incident, it’s a Ledger incident,” X user MyCryptoParadise wrote. “At least take ownership of this mess.”
The episode is distinct from an April phishing campaign involving a fake Ledger Live app on Apple’s App Store, which drained at least $9.5 million after users entered their recovery phrases. This time, the attacker appears to have obtained the keys needed to directly empty hundreds of wallets.
Ledger advised CryptoBilis customers not to set up unused devices. Those who have already used one should move assets to a new device with a newly generated recovery phrase, it said.
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Asanat Analysis — Why it matters
Ledger's containment claim hinges on a critical vulnerability: compromised supply-chain logistics rather than a product flaw. If all confirmed CryptoBilis cases trace to one Southeast Asian reseller, this suggests the attack vector was physical interception or insider manipulation at the distribution layer—a third-party risk Ledger outsources but ultimately owns. The $93M tracing and $10M freeze indicate significant but not catastrophic scale, yet the reputational damage transcends the dollar amount. Hardware wallets derive their security proposition entirely from integrity of the physical object; any breach at the point of sale undermines the core value proposition regardless of affected unit count.
The authorized-channel designation complicates Ledger's liability narrative. Resellers operating under Ledger's branding agreement are extensions of the company's distribution promise, not independent actors. Customers reasonably expect that 'authorized' implies security oversight. This forces Ledger into defending either (a) that it adequately vets and monitors resellers, or (b) that authorized status carries no security guarantees—both positions damage trust. The incident signals broader ecosystem friction: hardware-wallet makers profit from distribution breadth but resist accountability for it. Expect regulatory scrutiny on third-party risk frameworks in hardware security and potential new disclosure requirements for authorized channels globally.