Ledger says all confirmed cases involving the recent crypto theft are connected to hardware wallets sold by Southeast Asian reseller CryptoBilis. However, the company is facing criticism over its response because CryptoBilis was listed as an authorized seller on Ledger’s website.
Several blockchain analytics and intelligence firms have tracked up to $93.2 million in cryptocurrency stolen from wallets associated with Ledger devices purchased through the reseller.
Tether has frozen $10 million in USDT linked to the incident. Ledger said Sunday that investigations into the theft, which first came to light three days earlier, are continuing.
The hardware-wallet manufacturer confirmed that at least one affected device contained an unauthorized hardware implant. It has not clarified whether the wallet that suffered the loss was compromised through the same method or explained precisely how the devices were modified.
Bitquery, a blockchain analytics firm, estimated that $93.2 million was connected to the exploit. Its analysis found that attackers took mainly USDT and TRON tokens from 315 wallets spanning six blockchains. Meanwhile, security research platform YFarmX estimated the losses at $94.5 million, identifying activity across 521 addresses on seven blockchains.
The figures are based on publicly available blockchain records. Neither estimate represents a final loss total confirmed by Ledger.
Ledger did not immediately answer CoinDesk’s questions about the amount stolen or whether it intends to reimburse customers affected by the incident.
Tether Freezes Funds as Investigators Track the Stolen Crypto
The $10 million USDT freeze, confirmed by Bitquery, highlights the ability of stablecoin issuers to block tokens associated with suspected criminal activity. Bitcoin and ether, by contrast, cannot be frozen by a central issuer in the same way.
Bitquery reported that around $81 million remained traceable onchain as of October 11. Some of the funds had moved through Tornado Cash and Zcash, potentially making their subsequent movement more difficult to track.
Tether had not responded to CoinDesk’s request for comment on the freeze at the time of reporting.
Authorized Reseller Status Fuels Criticism
Ledger’s position that the cases are confined to devices sold through CryptoBilis has prompted objections from critics, who argue that the company should take responsibility for products distributed through an authorized sales channel.
“It’s not a CryptoBilis incident, it’s a Ledger incident,” X user MyCryptoParadise wrote, urging the company to acknowledge its responsibility.
The case is different from an April phishing operation involving a fake Ledger Live app available through Apple’s App Store. That campaign reportedly drained at least $9.5 million after victims entered their wallet recovery phrases into the fraudulent application.
In the CryptoBilis incident, the attacker appears to have obtained the keys required to empty hundreds of wallets directly, rather than tricking users into revealing their recovery phrases.
Ledger has warned customers who purchased devices through CryptoBilis not to activate any unused units. Those who have already used their devices have been advised to transfer their holdings to a new device configured with a newly generated recovery phrase.
