Tether froze $10 million in USDT following reports of a large theft affecting Ledger hardware wallets distributed by CryptoBilis, a third-party vendor active in Malaysia, Indonesia, and the Philippines. Investigators have traced the total assets stolen to as much as $93 million, mainly targeting TRON and USDT holdings, as officials work to track the movement of the stolen cryptocurrencies.
Ledger links incident to third-party reseller
Ledger, a leading French cryptocurrency hardware wallet manufacturer, stated that the affected wallets originated from devices sold by CryptoBilis. According to the company, there is no indication that its internal systems, services, or direct sales channels have been compromised.
A further investigation revealed a physical compromise on some devices. On October 10, Ledger identified an unauthorized hardware implant inside at least one compromised wallet, marking the first known evidence of a physical attack in this incident.
Ledger urged customers who purchased a CryptoBilis-supplied wallet in the past 90 days and have not yet configured it to leave the device unused. Existing users were advised to transfer assets to a new device and create a new recovery phrase.
Different estimates for funds stolen
Independent on-chain analysts have attempted to quantify the full extent of the losses. Bitquery, a blockchain analytics firm, attributed the attack to a theft of $93.2 million across 315 wallets spread over six blockchains. Another platform, YFarmX, placed the figure higher, estimating $94.5 million lost from 521 wallets on seven chains. Both relied on data from public blockchains.
| Source | Total Stolen | Number of Wallets | Number of Blockchains |
|---|---|---|---|
| Bitquery | $93.2 million | 315 | 6 |
| YFarmX | $94.5 million | 521 | 7 |
Bitquery reported that approximately $70.5 million in TRON, $16.8 million in Bitcoin, and $3.7 million in Ethereum were stolen. Smaller amounts disappeared from BNB Chain, Polygon, and Solana. The addresses linked to the scheme were created on September 25, and numerous test transactions were observed before the main attack in early October.
On October 9, the attackers reportedly modified permissions for 30 TRON wallets ahead of transferring 203.8 BTC from 111 Bitcoin wallets in a single block. Such transfers require the private keys, suggesting an advanced operation involving premeditated access.
The ability to freeze assets makes stablecoin issuers like Tether central to investigations in such cases. Bitquery verified that about $81 million in traceable assets remained on-chain as of October 11, though some funds attempted to evade tracking via crypto mixing tools like Tornado Cash and Zcash.
Mini dictionary: Tornado Cash is a privacy protocol on Ethereum that enables users to obfuscate the source and destination of funds by mixing transactions, complicating efforts to trace cryptocurrencies involved in illicit activity.
Community response and ownership questions
The classification of the incident as a CryptoBilis-specific case prompted criticism from the crypto community. CryptoBilis had been authorized as an official Ledger reseller, which led some users to call for greater accountability from Ledger. Some critics insisted that the incident should be recognized as a broader Ledger issue due to the vendor’s official reseller status.
Arravind Prabu, a co-founder of CryptoBilis, said the company was acquired in March 2026, and all access credentials were transferred at that time. Only one new investor was registered in China, and no evidence has surfaced connecting the ownership transition with the thefts. Investigators have not found tampering linked to the new investors.
In response to the ongoing investigation, CryptoBilis suspended all hardware wallet sales and closed its retail locations across Malaysia, Indonesia, and the Philippines.
Ledger continues to coordinate with affected users and relevant authorities during the investigation.
Hardware implant discovered
A significant discovery concerning the nature of the compromised devices came from Mark Karpelès, founder of Mt. Gox. After dismantling a Ledger Nano X device purchased in Malaysia, Karpelès identified covert hardware components: a cellular modem, an eSIM, and a small chip capable of intercepting what the screen displayed.
During device setup, recovery phrases appear on the wallet’s display. A component intercepting this data could transmit the recovery words over a mobile network, enabling remote wallet recreation and subsequent theft. It remains unclear whether all compromised devices contained such a module.
This case is unrelated to another theft from March, where phishing using the Ledger Live app on Apple’s App Store led to additional losses estimated at a minimum of $9.5 million.
