Ledger Claims CryptoBilis Cases Are Limited: Up to $93 Million Traced, $10 Million Frozen

Ledger said every confirmed case involves devices sold by its Southeast Asia sales partner, but critics argue that the hardware wallet maker should be held accountable for an authorized sales channel.

According to several blockchain intelligence and analytics companies, $93.2 million in cryptocurrency has been mined from wallets linked to ledger devices sold by vendor CryptoBilis.

Tether has frozen $10 million USDT linked to the heist, while Ledger said on Sunday that an investigation into the heist, which was first reported three days ago, is still ongoing.

The ledger confirmed the installation of unauthorized hardware on at least one affected device. The company did not say whether the stolen wallet was compromised in the same way or how the devices were tampered with.

Blockchain intelligence and analytics company Bitquery announced that it has traced $93.2 million linked to ledger abuse. According to the report, hackers stole most of the USDT and TRON tokens from 315 wallets across six blockchains. Security research platform YFarmX reported higher numbers, saying attackers withdrew $94.5 million from 521 addresses across seven blockchains. Both estimates are based on public blockchain data, not a verified ledger loss total.

Ledger did not immediately respond to CoinDesk's request to confirm the amount stolen and whether it is considering a refund plan for those affected by the abuse.

The Tether freeze, approved by Bitquery, is important because stablecoin issuers can freeze tokens linked to crime, unlike Bitcoin or Ether. Bitquery also said that roughly $81 million could still be traced on-chain as of October 11, while some funds were transferred via Tornado Cash and Zcash.

Teter did not immediately respond to CoinDesk's request for comment on the freeze.

Ledger's attempt to characterize the incident as limited to CryptoBilis was met with opposition because the vendor was listed as authorized on Ledger's website. MyCryptoParadise user X wrote: "This is not a CryptoBilis incident, it's a Ledger incident." "At least own this mess."

This episode is separate from an April phishing campaign involving a fake Ledger Live app on Apple's App Store, which drained at least $9.5 million after users entered recovery phrases. This time, the attacker appears to have obtained the keys needed to directly empty hundreds of wallets.

Ledger advised CryptoBilis customers not to run unused devices. Those who have already used it should transfer the assets to a new device with a newly generated recovery clause.

Diversified RWA stablecoins maintain a 5-7% return on real credit as crypto funding drops to 4%. GENIUS increases performance off-chain. TAM increases to $4 billion in 3 years.