Blockchain analytics organizations estimate that wrongdoers drained up to $94.5 million from multiple wallets associated with Ledger hardware wallets purchased through the authorized distributor CryptoBilis, though Ledger has refrained from verifying the exact figure.
Ledger identified a rogue physical modification inside at least one impacted unit, while Tether locked $10 million worth of USDT connected to the breach as specialists persist in tracking the capital.
Ledger suggested that CryptoBilis buyers avoid activating unopened units and strongly encouraged individuals already utilizing them to migrate their holdings to an alternative device featuring a newly established seed phrase.
Roughly $93.2 million in digital currency was drained from accounts connected to Ledger hardware supplied by the vendor CryptoBilis, according to findings from several blockchain tracking and forensic enterprises.
Tether has locked $10 million in USDT associated with the breach, whereas Ledger noted on Sunday that inquiries into the security failure, initially highlighted three days prior, are still ongoing.
Ledger validated a malicious hardware modification within at least one compromised unit. The enterprise refrained from specifying whether the emptied account suffered a breach through identical means or how the units were compromised.
Blockchain forensics and intelligence business Bitquery reported tracking $93.2 million connected to the Ledger security event. The firm stated that the perpetrators stole primarily USDT and TRON assets across 315 accounts spanning six separate distributed ledgers. Security investigation network YFarmX stated a higher figure, noting that the attackers siphoned $94.5 million across 521 destinations over seven distinct networks. Both calculations rely on public network information instead of an officially verified total from Ledger.
Ledger did not immediately respond to a CoinDesk inquiry to verify the stolen sum or whether it contemplates launching a compensation initiative for individuals impacted by the security breach.
The Tether asset freeze, verified by Bitquery, holds significant weight because fiat-pegged stablecoin operators possess the capability to restrict coins associated with illegal activity, unlike bitcoin or ether. Bitquery additionally noted that approximately $81 million remained traceable on-network as of October 11, while a portion of the capital had routed through Tornado Cash and Zcash.
Tether did not immediately reply to a CoinDesk inquiry for remarks concerning the asset freeze.
Ledger’s endeavor to frame the security breach as restricted solely to CryptoBilis has sparked criticism because the merchant appeared on Ledger’s official web platform as an approved seller. “It’s not a CryptoBilis incident, it’s a Ledger incident,” X account user MyCryptoParadise stated. “At least take ownership of this mess.”
This occurrence differs from a fraudulent April social engineering scheme featuring a malicious Ledger Live program on the Apple App Store, which stole at least $9.5 million after customers inputted their recovery keys. In the current scenario, the bad actor seems to have acquired the required keys to directly drain numerous accounts.
Ledger recommended that CryptoBilis buyers refrain from configuring unopened units. Individuals who already operated one ought to transfer holdings to a fresh piece of hardware accompanied by a newly generated seed phrase, the firm stated.
Originally published at https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen.
