TLDR
- Analysts say up to $94.5 million was stolen from wallets tied to Ledger devices sold by CryptoBilis.
- Tether has frozen $10 million in USDT linked to the theft.
- Ledger confirmed an unauthorized hardware implant in at least one affected device.
- About $81 million could still be traced onchain as of Oct. 11.
- The exploit has renewed debate over hardware wallets and Bitcoin ETFs.
Blockchain analytics firms say attackers stole up to $94.5 million from wallets linked to Ledger devices. The devices were sold by CryptoBilis, a reseller in Southeast Asia.
Ledger has not confirmed the total loss. The company said Sunday that its investigations are still underway, and the theft was first reported three days earlier.
72 hour update on reseller CryptoBilis incident 🔽
As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.…
— Ledger (@Ledger) October 11, 2026
Ledger said every confirmed case involves devices sold by CryptoBilis. The reseller was listed as authorized on Ledger’s website, and critics say the company must answer for that sales channel.
What the Analytics Firms Found
Bitquery said it traced $93.2 million linked to the exploit. It said the hackers took mostly USDT and TRON tokens from 315 wallets across six blockchains.
YFarmX reported a higher figure of $94.5 million. It said the funds left 521 addresses across seven blockchains.
Both estimates rely on public blockchain data. Neither is a confirmed loss total from Ledger.
Some investigators estimated that losses from the implants could top $86 million. Estimates vary between firms.
Ledger confirmed an unauthorized hardware implant in at least one affected device. The company did not say how the devices were tampered with.
Ledger also did not say whether the stolen wallet was compromised in the same way. It did not immediately respond to a request about a reimbursement plan.
Funds Frozen and Traced
Tether has frozen $10 million in USDT tied to the theft. Bitquery confirmed the freeze.
Stablecoin issuers can block tokens linked to crime, unlike bitcoin or ether. Tether did not immediately respond to a request for comment.
Bitquery said about $81 million could still be traced onchain as of Oct. 11. Some funds moved through Tornado Cash and Zcash.
Ledger’s effort to call the incident limited to CryptoBilis has drawn pushback. One X user wrote, “It’s not a CryptoBilis incident, it’s a Ledger incident.”
The case differs from an April phishing campaign that used a fake Ledger Live app on Apple’s App Store. That scheme drained at least $9.5 million after users entered their recovery phrases.
Ledger told CryptoBilis customers not to set up unused devices. Those who already used one should move assets to a new device with a newly generated recovery phrase.
⚠️ Update ⚠️
I moved my bitcoin to ETFs in 2025 and got a lot of heat for that decision.
Then the Coldcard entropy issues came out.
Then Ledger devices with unauthorized hardware implants were discovered.Zero regrets of my ETF decision. Peace of mind. https://t.co/x7Z5XeCd6q
— PlanB (@100trillionUSD) October 12, 2026
The exploit has sparked debate over hardware wallets versus Bitcoin ETFs. Analyst Plan B wrote Monday on X that he has “zero regrets” about moving his Bitcoin to ETFs in 2025.
21Shares co-founder Ophelia Snyder said large holders have moved to ETFs for security for years. Blockstream CEO Adam Back said hardware wallets can still be secure, but makers need better threat modeling.
Bitcoin security researcher Jameson Lopp said self-custody remains a strong option. He urged investors to avoid mass migration that could create new central points of failure.
