Ledger links up to $93M wallet drain to devices sold by reseller CryptoBilis

Hundreds of Ledger hardware wallet users in Southeast Asia who bought their devices from the reseller CryptoBilis lost an estimated $72 million to $93 million in coordinated drains on October 9, according to blockchain analysts cited by Gizmodo, Protos, Decrypt and Bitquery. Ledger said it believes the losses are limited to devices sold through CryptoBilis, which it lists as a reseller for Indonesia, Malaysia and the Philippines, and asked the reseller to pause all sales and shipments. According to Crypto Briefing, Ledger confirmed on October 10 that at least one device sold by CryptoBilis contained an unauthorized hardware implant that gave attackers access to the owner's recovery phrase.

What happened

The drains were first flagged by on-chain investigators Specter and Tanuki42, who traced inflows from hundreds of victim wallets across Ethereum, TRON and Bitcoin, Protos and Decrypt reported. Specter put losses at more than $86 million, while Arkham data cited by Gizmodo showed about $71.5 million in flagged addresses on the afternoon of October 9.

Bitquery, in an analysis last updated on October 11, counted $93.2 million taken from 315 wallets. By its count, $70.5 million came from TRON, $16.8 million from Bitcoin and smaller amounts from Ethereum, BNB Chain, Polygon and Solana. Bitquery's timeline shows a new key being added to 30 TRON wallets at 04:59 UTC on October 9, locking out their owners, followed by about $29 million being pulled out within seconds, and 111 Bitcoin wallets emptied in a single block at 05:54 UTC. The firm said the thief ran test transactions between September 25 and October 7.

Ledger has not confirmed a dollar figure or how many devices were affected. The company said it has no indication that its own security infrastructure, systems or services were compromised, Gizmodo reported.

Technical details

The suspected cause is physical tampering in the supply chain rather than a software flaw. Before Ledger's reported confirmation, former Mt. Gox CEO Mark Karpelès posted photos of a Ledger he said he bought in Malaysia that contained a hidden second board with an LTE module and data eSIM, according to Gizmodo. He did not say the device came from CryptoBilis, and the claim has not been independently verified. Crypto Briefing said Ledger's statement did not include further technical detail about how the implant worked, and that Ledger reminded resellers never to restock returned products.

Security researcher Taylor Monahan warned that there did not appear to be a zero-day vulnerability, and cautioned that phishing, fake Google ads and fake apps could target users rushing to migrate funds, Protos reported.

Who is affected

The affected group is customers who bought Ledger devices from CryptoBilis in roughly the last three months. Protos and Gizmodo noted that CryptoBilis also sells Trezor, OneKey, Tangem and SafePal wallets, although no drains involving those brands have been confirmed. Bitquery said Tether blocked 37 addresses and that about $10 million in USDT remains frozen, a fraction of the total; funds on chains such as Bitcoin cannot be frozen by any central party.

What to do

Ledger advised anyone who bought from CryptoBilis in the past 90 days not to set up an unused device, and those already using one to move assets to a new Ledger signer with a new seed phrase. Owners of any hardware wallet bought through a third party should verify where it came from, buy directly from the manufacturer or a verified reseller, and only download wallet software from official sources.