Bitquery analysts estimate that $93.2 million was stolen from 315 cryptocurrency wallets across six blockchains. The funds belonged to Ledger users who purchased devices from the Southeast Asian reseller CryptoBilis. The theft occurred on October 9, with the attacker draining the wallets within 47 minutes.
The majority of the stolen funds were in the TRON network, totaling approximately $70.5 million, followed by $16.8 million in Bitcoin. Bitquery noted that the attacker used automated systems or pre-obtained keys to execute the transfers. Tether has since blocked 37 addresses associated with the incident, containing about $10 million in USDT.
Ledger confirmed that its internal systems remain secure and that no devices purchased directly from the manufacturer were affected. The company requested that CryptoBilis suspend sales and advised customers who bought devices from the reseller in the last 90 days to avoid setting them up. Ledger also identified an unauthorized hardware implant in one affected device.
Tibane Labs researchers analyzed two Ledger Nano X devices with suspected implants, suggesting these components could intercept seed phrases via display signals. While the investigation continues, the exact method of compromising all 315 wallets remains unconfirmed. Users are advised to transfer assets to new devices with fresh seed phrases.
