On October 9, multiple Ledger users in Southeast Asia reported that their wallets had been drained after purchasing devices through distributor CryptoBilis. Upon receiving the reports, Ledger launched an investigation into the cause and instructed the retailer to suspend all sales and product deliveries.
Unusual Signs and Initial Extent of Losses
Data from Bitquery shows that small-scale test transactions had been initiated approximately two weeks prior to the mass withdrawals across various blockchain platforms. Because numerous wallet addresses simultaneously approved requests within seconds, experts believe a third party likely gained control of the security keys.
Nevertheless, blockchain analysis has not yet determined the method of key leakage. Current hypotheses focus on hardware tampering or recovery seed phrases being stolen before reaching customers; the official cause has not yet been determined, and there is insufficient basis to confirm that all incidents originated from CryptoBilis.
Additionally, blockchain tracking organization MistTrack stated that as of October 9, Tether had proactively locked USDT at the implicated wallet addresses. The organization estimated the financial impact at approaching $90 million. It should be noted that this is merely a preliminary assessment based on real-time tracking, not a verified overall loss.
The current situation presents two main facets: fund tracking is underway to assist victims, but the root cause remains an open question. Notably, the draining of assets from Ledger wallets cannot be considered evidence that the secure chips across the entire product lineup have been compromised.
Tracking Fund Flows and Asset Recovery Realities
Analyst Specter traced funds through multiple recipient addresses and uncovered fund transfers originating from hundreds of wallet addresses across the Ethereum, TRON, and Bitcoin networks. The total value of assets in reported drained wallets posted on X and Reddit was estimated to exceed $86 million. These figures reflect point-in-time estimates from continuously shifting datasets and therefore cannot be aggregated into a single total loss. Meanwhile, analytics firm MistTrack said it is coordinating to assist several victims in handling the incident.
Although the exact amount of locked USDT remains unconfirmed, independent data provided by Bitquery indicates that Tether froze approximately 10 million USDT. Tether’s freezing of suspicious accounts is intended to aid the investigation and is entirely separate from actual asset restitution; thus, the nearly $90 million figure should not be understood as funds reimbursed or successfully rescued by Tether for users.
Suspicion Centers on the Distribution Process
Regarding reports from customers who purchased devices through Southeast Asian retailer CryptoBilis, Ledger stated that it is conducting an investigation to clarify the matter. The company requested that the reseller temporarily halt sales and deliveries during the verification process. This is an initial precautionary measure and does not imply a conclusion that all products distributed by CryptoBilis were tampered with.
Mark Karpelès, former CEO of the Mt. Gox exchange, hypothesized that the devices may have been implanted with tracking components and urged victims to provide details to assist in examinations. However, the connection between this suspicion and the asset losses remains unproven. Changpeng Zhao also suggested that initial data points toward supply-chain risks at the retail level, though this remains an individual assessment rather than an official forensic conclusion.
For the user community, the key priority now is awaiting Ledger’s announcement regarding the specific cause and the identities of any affected batches. Having a transparent technical report to cross-reference each individual case will be far more practical than prematurely assigning blame to hardware failures without conclusive evidence.