- Blockchain firms traced up to $93.2 million tied to Ledger devices sold by CryptoBilis.
- Tether froze $10 million in USDT linked to the theft as investigators continued tracing funds.
The Ledger CryptoBilis case remains under investigation after blockchain analytics firms linked a large theft to Ledger devices sold by the authorized reseller CryptoBilis. Public blockchain estimates put the amount traced at as much as $93.2 million, while another research platform reported a higher figure of $94.5 million. Ledger said every confirmed case involves devices sold by CryptoBilis and confirmed that at least one device contained an unauthorized hardware implant. The company also told affected customers not to use unopened devices and urged those who had already used one to move assets to a new device with a newly generated recovery phrase.
Ledger CryptoBilis funds traced across blockchains
Several blockchain analysis firms said they traced major losses connected to wallets linked to Ledger devices sold by CryptoBilis. Bitquery reported $93.2 million tied to the exploit, based on public blockchain data rather than a confirmed total from Ledger. The firm said the stolen assets were mainly USDT and TRON tokens.
Bitquery added that the theft affected 315 wallets across six blockchains. YFarmX published a higher estimate, saying attackers took $94.5 million from 521 addresses across seven blockchains. Ledger had not confirmed the total amount stolen and did not immediately respond to a request about the figure or whether it was considering reimbursement for affected users.
Investigation details and the Tether freeze
Ledger said investigations were still underway three days after the theft was first reported. The company confirmed that at least one affected device contained an unauthorized hardware implant, but it did not say whether the stolen wallet was compromised in that same way or explain how the tampering happened.
Bitquery said Tether froze $10 million in USDT tied to the theft. The firm noted that stablecoin issuers can block tokens linked to crime, unlike bitcoin or ether. It also said about $81 million could still be traced onchain as of Oct. 11, although some of the funds had already moved through Tornado Cash and Zcash.
Ledger CryptoBilis response faces criticism
Ledger has tried to describe the incident as limited to CryptoBilis, saying every confirmed case involved devices sold by that reseller. That position drew criticism because CryptoBilis had been listed as an authorized reseller on Ledger’s website, leading some observers to argue that Ledger still bears responsibility for the sales channel.
One X user, MyCryptoParadise, rejected the distinction and called it a Ledger incident rather than a CryptoBilis incident. The criticism focused on Ledger’s need to address what happened through an authorized distribution path, even as the company continued to frame the confirmed cases around one reseller.
Advice for affected customers
Ledger told CryptoBilis customers not to set up any unused devices. For users who had already activated one of those devices, the company advised moving assets away and creating protection through a new device with a newly generated recovery phrase.
The company also distinguished this case from an April phishing campaign involving a fake Ledger Live app on Apple’s App Store. That earlier incident drained at least $9.5 million after users entered their recovery phrases. In the current Ledger CryptoBilis case, the attacker appears to have obtained the keys needed to directly empty hundreds of wallets.
Conclusion
The Ledger CryptoBilis investigation centers on devices sold by an authorized reseller, with public blockchain estimates placing the traced theft at up to $93.2 million and another analysis reporting $94.5 million. Ledger confirmed an unauthorized hardware implant in at least one device, while Tether froze $10 million in USDT and Bitquery said roughly $81 million remained traceable onchain as of Oct. 11. Ledger has advised affected users to avoid unused devices and transfer assets to a new device with a newly generated recovery phrase. At the same time, the company’s effort to limit the incident to CryptoBilis has faced criticism because the reseller was listed as authorized on Ledger’s website.
Disclaimer
The information provided in this article is for informational purposes only and should not be considered financial advice. The article does not offer sufficient information to make investment decisions, nor does it constitute an offer, recommendation, or solicitation to buy or sell any financial instrument. The content is opinion of the author and does not reflect any view or suggestion or any kind of advise from CryptoNewsBytes.com. The author declares he does not hold any of the above mentioned tokens or received any incentive from any company.
Featured image created by AI
