Ledger has stated that every confirmed case linked to the recent cryptocurrency theft involves hardware wallets sold by Southeast Asian reseller CryptoBilis. The explanation has drawn criticism, however, because CryptoBilis was identified as an authorized retailer on Ledger’s website, raising questions about the manufacturer’s responsibility for products sold through its approved distribution network.
Blockchain intelligence firms estimate that up to $93.2 million in digital assets was taken from wallets connected to Ledger devices purchased through CryptoBilis.
Tether has frozen $10 million worth of USDT associated with the incident. Ledger said Sunday that investigations into the theft, which was first reported three days earlier, are still in progress.
The company acknowledged that investigators found an unauthorized hardware implant in at least one affected device. However, Ledger has not confirmed whether the wallet that lost funds was compromised through the same method or explained how the devices were modified.
Bitquery traced approximately $93.2 million in assets linked to the incident, reporting that the attackers primarily stole USDT and TRON tokens from 315 wallets across six blockchains. YFarmX, a security research platform, estimated the amount at $94.5 million, identifying transactions involving 521 addresses across seven blockchains. Both assessments rely on public blockchain records rather than a definitive loss figure provided by Ledger.
Ledger did not immediately respond to CoinDesk’s request for clarification on the total amount stolen or whether it would reimburse customers who suffered losses.
$10 Million USDT Freeze Offers a Potential Recovery Path
Tether’s decision to freeze $10 million in USDT, confirmed by Bitquery, is significant because stablecoin issuers can block specific tokens associated with suspected illicit activity. Bitcoin and ether lack an equivalent centralized issuer mechanism.
According to Bitquery, roughly $81 million in stolen assets could still be tracked onchain as of October 11. Some funds had passed through Tornado Cash and Zcash, complicating efforts to follow their movement.
Tether had not responded to CoinDesk’s request for comment about the freeze.
Ledger Faces Questions Over CryptoBilis Sales
Ledger’s claim that the confirmed cases are limited to devices sold by CryptoBilis has prompted criticism from cryptocurrency users. They argue that the company should address the incident directly because the reseller was listed as an authorized seller.
“It’s not a CryptoBilis incident, it’s a Ledger incident,” X user MyCryptoParadise wrote, calling on Ledger to take responsibility for the situation.
The incident differs from a phishing campaign in April, when a counterfeit Ledger Live application appeared on Apple’s App Store. That operation reportedly cost victims at least $9.5 million after they entered their recovery phrases into the fake app.
In the latest case, the attacker appears to have gained access to the cryptographic keys needed to drain hundreds of wallets directly, rather than relying on users to disclose their recovery phrases.
Ledger has advised CryptoBilis customers who have not yet activated their devices to leave them unused. Those who have already set up a device should move their funds to a new device and create a fresh recovery phrase, the company said.
