Ethena founder and CEO Guy Young has said that the large investor onchain transfers that occurred over the past 48 hours were a defensive move tied to the recent Ledger hardware wallet scare.
He wrote in a post on X that it is not a sign the holder is dumping tokens.
ENA holders who had spotted the activity had feared a whale was heading for the exit.
What Young actually said
Young confirmed in his X post that the moves were “a security precaution related to the recent hardware wallet concerns, not coins being moved and sold.”
Users had raised alarms about a major wallet relocating tokens. Usually, when news like this one circulates, users may assume that it is a security breach or a coordinated dump, and the resulting actions could cause the token itself to crash.
Young stepped in to calm the nerves as he said that the transfers were preventive and not the investor selling.
Ethena has drawn scrutiny before over large holders shifting tokens to exchanges.
The hardware wallet scare behind the move
The hardware wallet concerns that Young mentioned in his post are linked to the ongoing investigation that Ledger opened on October 9 concerning drained funds from its devices that were sold by Southeast Asian reseller CryptoBilis.
Ledger later said the cause was a covert chip hidden inside some CryptoBilis-sold units.
The implant read a user’s 24-word recovery phrase off the device screen during setup and transmitted it to an attacker over an LTE mobile network using an eSIM.
The attack is being described as a physical supply-chain attack. Ledger said that it has no indication that its infrastructure, systems or services or direct sales channel has been compromised.
Cryptopolitan reported that onchain researchers pegged losses at between $84.2 million and $93.2 million across more than 300 wallets, with Tether freezing $10 million in USDT tied to the thefts. Ledger has not confirmed a victim count or a dollar total.
The fallout from that incident spread across the industry, with fellow hardware wallet provider Trezor cutting its authorized reseller network. It informed its partners that their status ends by January 1, 2027. Trezor said that it found no evidence that its own devices were compromised. CryptoBilis halted sales of all brands it carried.
MediaMarkt Saturn, a Ledger hardware reseller in Germany, has halted the sale of those devices as a precaution following the supply chain breach.
Why an investor would reshuffle holdings now
Ledger urged its users to move their coins to a fresh signer. It also advised anyone who bought their hardware wallet from CryptoBilis within the past 90 days to leave unused devices untouched. For those already using the devices, Ledger told them to transfer assets to a new device with a newly generated recovery phrase.
That advice lines up with what Young described as what the investor was doing. It was a case of rotating funds for safety and not liquidation. So far, there is no other incident that challenges Young’s statement, and that means that the users will have to take his words for it and observe movements for the coming days.
Ethena did not name the investor or disclose the size of the transfers. Ethena runs the synthetic dollar protocol behind USDe.
If you're reading this, you’re already ahead. Stay there with our newsletter.