Ledger said on Oct. 11 that “the volume of impacted devices is limited,” and that every confirmed case in the Oct. 9 wallet drains traces back to one seller. “To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis,” the hardware wallet maker wrote, adding, “Our systems and direct sales channels remain unaffected.”
The 72-hour update did not include a loss figure, a count of affected devices, or an explanation of how the devices were tampered with.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What Ledger Told Buyers
A day earlier, the Ledger Support account said in a post on X that “one of the impacted users’ devices contained an unauthorized hardware implant.” It added that CryptoBilis had stopped selling hardware wallets until the investigation ends.
Ledger told CryptoBilis customers not to set up unused devices and, if they already had, to move to a new recovery phrase on a device from Ledger. It said it is working with authorities, reviewing controls on its authorized resellers, and reminding them “never to restock returned products.”
How Much Was Taken
Without a number from Ledger, the totals come from onchain trackers, and they do not agree. Blockchain data firm Bitquery tallies $93.2 million across six blockchains, pulled from 315 wallets and mostly held as USDT on TRON. Security research site YFarmX puts the figure at $103.4 million from 530 addresses on seven blockchains, after adding nine more drained TRON wallets in an Oct. 12 update. Unchained first reported the drains on Oct. 9, when early tallies were built from a handful of public addresses.
Where the Money Went
Per Bitquery, Tether blocked 37 addresses linked to the theft, leaving $10 million in USDT frozen across 20 of them. The blockchain data firm said it traced 2,990 ETH that the thief pushed through Tornado Cash and then Zcash to seven wallets, five of which held 5.35 million USDC on Oct. 11 and were emptied, ahead of any freeze. Bitquery put the amount it could still follow onchain at about $86 million on Oct. 11.
“The record points to one actor who held the keys to every one of those wallets,” Bitquery wrote in its investigation, while noting that “the chain cannot show where the keys leaked from.”
Related Listen: How Cory Klippsten Would Decide How to Secure Bitcoin Post-Coldcard
The post Ledger Says All Confirmed Cases Trace to Reseller CryptoBilis, Gives No Loss Total appeared first on Unchained.