Ledger Says CryptoBilis Impact Is Limited Despite $93M in Traced Funds

Ledger says the confirmed cases linked to the recent cryptocurrency theft all involve hardware wallets sold by Southeast Asian reseller CryptoBilis. The company’s explanation has drawn criticism, as CryptoBilis was listed as an authorized retailer on Ledger’s website. Critics argue that Ledger must address its responsibility for devices distributed through an approved sales channel.

Blockchain analytics and intelligence firms have traced up to $93.2 million in cryptocurrency associated with wallets linked to the reseller’s devices.

Tether has frozen $10 million in USDT connected to the theft, while Ledger said Sunday that investigations are continuing. The incident was first reported three days earlier.

Ledger acknowledged that an unauthorized hardware implant had been discovered in at least one affected device. However, the company has not confirmed whether the wallet from which funds were stolen was compromised through the same mechanism or explained how the devices were tampered with.

Bitquery, a blockchain analytics firm, estimated that $93.2 million was linked to the exploit. Its analysis found that attackers stole mainly USDT and TRON tokens from 315 wallets across six blockchains. YFarmX, a security research platform, reported a higher estimate of $94.5 million, based on activity involving 521 addresses across seven blockchains.

The figures come from public blockchain data and have not been independently confirmed by Ledger as the total amount lost.

Ledger did not immediately respond to CoinDesk’s request for comment on the estimated losses or whether it plans to reimburse customers affected by the incident.

Tether Freezes $10 Million in Stolen USDT

The $10 million freeze, confirmed by Bitquery, highlights a key difference between stablecoins and decentralized cryptocurrencies. Stablecoin issuers such as Tether can block specific tokens associated with suspected illicit activity, whereas bitcoin and ether do not have a central issuer with the same control.

Bitquery reported that approximately $81 million remained traceable onchain as of October 11. Some of the funds had passed through Tornado Cash and Zcash, complicating efforts to track their movement.

Tether had not immediately responded to CoinDesk’s request for comment on the freeze.

Ledger Faces Scrutiny Over Authorized Sales Channel

Ledger’s position that the confirmed cases are restricted to devices sold by CryptoBilis has prompted criticism from cryptocurrency users. They argue that the company should take responsibility because the reseller was identified as an authorized seller on its website.

“It’s not a CryptoBilis incident, it’s a Ledger incident,” X user MyCryptoParadise wrote, urging Ledger to acknowledge its role in the matter.

The incident is separate from an April phishing campaign involving a fake Ledger Live app distributed through Apple’s App Store. That operation reportedly led to at least $9.5 million in losses after users entered their recovery phrases into the fraudulent app.

In the latest cases, attackers appear to have obtained the cryptographic keys needed to empty hundreds of wallets directly, rather than tricking users into revealing their recovery phrases.

Ledger has advised customers who bought devices through CryptoBilis not to activate any unused units. Customers who have already used their devices should move their funds to a new device and generate a fresh recovery phrase, the company said.