Tether has frozen $10 million of its USDT cryptocurrency after a theft drained up to $93 million in assets from Ledger hardware wallets sold by CryptoBilis, as the investigation into the money flow continues and Ledger claims the problem is isolated.
Confirmed information provided by Ledger so far
The French cryptocurrency wallet maker has yet to comment on the losses. Ledger has said that all cases the company has identified involve devices sold by CryptoBilis, a third-party vendor that operated in Malaysia, Indonesia and the Philippines. The company also stressed that there were no signs of compromise of Ledger’s systems, services and direct sales.
A discovery added an element of physical tampering to the case of software-related vulnerabilities. On October 10, the firm stated that one of the affected users owned a device that had an unauthorized physical implant installed, which has become the first evidence of physical compromise of Ledger wallets in this case.
The message for buyers from its side is very clear. If you have bought a CryptoBilis device within the last 90 days and did not configure it yet, leave it untouched. If you are using the device right now, transfer your coins to another device with a new recovery phrase.
How investigators tallied the losses
These figures are attributed to on-chain analysts rather than Ledger. Bitquery estimated that the attack involved $93.2 million siphoned off from 315 wallets on six separate blockchains, primarily USDT and TRON coins. The security platform YFarmX set a higher number, claiming the attack took away $94.5 million from 521 wallets on seven different blockchains. Both estimates were based on public chain data.
According to Bitquery’s analysis, most of the stolen money is attributed to TRON at around $70.5 million, with another $16.8 million in Bitcoin and $3.7 million in Ethereum, and much smaller amounts in BNB Chain, Polygon and Solana. The operation is claimed to have been planned for months: the addresses involved in the theft were created on September 25 and made dozens of trial transfers until early October.
The major transfer took place on October 9 when Bitquery claims the attackers rewrote the permissions for 30 wallets on TRON before transferring some 203.8 BTC from 111 Bitcoin wallets within a single block an hour later. This sort of operation can be carried out only if the attacker has the necessary keys.
This is important since the issuers of the stablecoins are able to blacklist coins used for illegal activities. Bitquery, which verified the Tether freeze, reported that there was still about $81 million of traceable tokens on-chain as of October 11, but some funds have passed through the mixer services of Tornado Cash and Zcash.
Pushback over an authorized reseller
However, Ledger’s characterization of the situation as a CryptoBilis issue has not gone over smoothly. The reseller had an official badge of Ledger on their website, hence making Ledger responsible for this situation since, “It’s not a CryptoBilis incident, it’s a Ledger incident.” X user MyCryptoParadise told the company to “take ownership of this mess.”
There is yet another side to the story from the history of the reseller. According to Arravind Prabu, one of the co-founders, CryptoBilis was acquired in March 2026, and the entire team transferred all system access during the acquisition, as quoted in Learning Crypto.
The only new investor in the company was registered in China, as per the company’s reported records. So far, there have been no links made between the thefts and the ownership change and the investigation found no tampering with new investors.
CryptoBilis has suspended sales and deliveries of all brands that it sells and shut down its brick-and-mortar stores in all three countries.
The implant Mark Karpelès pulled apart
Perhaps the most definitive description of the hardware can be given by the founder of Mt. Gox, Mark Karpelès. Karpelès disassembled a Ledger Nano X purchased in Malaysia and, as reported by Learning Crypto, discovered additional components that were hiding under the screen: a cellular modem, an eSIM and a tiny chip that would enable it to intercept what was displayed on the screen.
When setting up the wallet, the recovery words are displayed on that screen. A component that can intercept the data from the display would allow the words to be sent using the mobile network and, as a result, the wallet to be recreated somewhere else and the money to be stolen. It still needs to be proven whether all of the devices contained those components.
It should be noted that this case is distinct from another theft in March, which happened in April when the Ledger Live application in Apple’s App Store was used by phishers to steal at least $9.5 million.
If you're reading this, you’re already ahead. Stay there with our newsletter.