A wallet holder described in a post on X as a crypto scammer lost over 60 BTC, worth $4.8 million, after a Ledger hardware wallet was compromised.
The loss was not a one-off. It sits inside a much larger supply-chain attack on Ledger devices sold through CryptoBilis, a Southeast Asian reseller. That attack reportedly drained hundreds of wallets in one coordinated burst.
How the attack worked
Ledger confirmed it found an unauthorized hardware implant inside at least one affected device. The implant captured the 24-word seed phrase users wrote down during setup.
It then sent those phrases out over cellular networks. A seed phrase is the master key to a wallet. Whoever holds it can rebuild the wallet anywhere and move every coin inside.
Unusual activity surfaced around October 9, 2026. The drains happened fast that day, hitting multiple wallets within a matter of seconds, according to Ledger’s description of the strike.
The numbers keep moving
Early loss estimates ranged from $72 million to $86 million. Those figures were later revised upward to between $93 million and $102 million across roughly 300-plus wallets.
Analysts tracking the collector addresses saw inflows in Bitcoin, Ethereum, TRON and stablecoins. Over 324 wallets were involved, per the research findings.
Bitcoin tallies also shifted as investigators dug in. Early counts showed about 211 BTC, totaling roughly $17.5 million. Other analyses put the figure at more than 203 BTC.
Individual losses were large. One victim reportedly moved about 80 BTC into a new Ledger shortly before the October 9 attack, a holding valued at approximately $4.8 million at the time.
Another victim reported losing about 60 BTC. The X post tied the over 60 BTC loss, valued at $4.8 million, to the alleged scammer.
Tether froze about $10 million in USDT linked to the exploited addresses.
Ledger points to the reseller
Ledger said every verified case traced back to purchases from CryptoBilis. The company stated that its own systems and direct sales channels remained secure.
CryptoBilis temporarily paused sales after the discovery.
Ledger characterized the perpetrators as a highly organized criminal group. According to the company, the group spent considerable effort building the implants before launching a coordinated strike.
As of mid-October 2026, Ledger was still publishing updates for users. It focused on customers who bought devices from CryptoBilis within the last 90 days.
The company urged caution during device setup and when moving assets to a new seed phrase. That second warning matters. Generating a fresh seed on a compromised device simply hands the attackers a new key.
Why the patience matters
The attackers did not drain wallets the moment seed phrases came in. Instead, they appear to have waited while victims loaded funds, then struck many wallets almost simultaneously. The 80 BTC victim reportedly deposited shortly before the attack.
This approach maximizes the haul and minimizes warning. If the group had emptied wallets one by one, early victims could have raised alarms and saved later ones.
What this means for self-custody
The research findings suggest the event could weaken consumer confidence in hardware wallet safety and self-custody more broadly. With an estimated $102 million taken within hours, that concern is not abstract.
The findings also flag possible regulatory scrutiny and louder demands for manufacturer accountability. Ledger has drawn a clear line around its own channels, but customers who lost funds may not find that distinction comforting.
There is a practical checklist for anyone holding a device from a third-party seller. Check the purchase source and date against Ledger’s 90-day guidance. Be wary of any device that arrived with packaging or components that seem off.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.