Ledger said the confirmed cases in a major cryptocurrency theft all involve hardware wallets distributed by Southeast Asian reseller CryptoBilis, while blockchain investigators traced as much as $93.2 million and Tether froze $10 million in USDT connected to the incident.
The case has placed scrutiny on Ledger’s authorized distribution network. The company has confirmed that at least one affected device contained an unauthorized hardware implant, but it has not explained whether the wallet from which funds were stolen was compromised through that same method. According to CoinDesk, investigations remain active and the total loss has not been confirmed by Ledger.
What investigators have traced
Blockchain analytics and intelligence firm Bitquery estimated that attackers took $93.2 million, mostly in USDT and TRON tokens, from 315 wallets operating across six blockchains. Security research platform YFarmX produced a higher estimate of $94.5 million, based on 521 addresses across seven blockchains.
Those figures come from analysis of public blockchain records rather than a confirmed loss figure from Ledger. The difference between the estimates reflects the difficulty of identifying every wallet and transaction connected to a crypto theft while funds are moved across networks and services.
Bitquery said about $81 million remained traceable on-chain as of October 11. Some of the assets had passed through Tornado Cash and Zcash, which can make transaction tracing more difficult by adding privacy features or obscuring the movement of funds.
Tether confirmed a freeze of $10 million in USDT linked to the theft, according to Bitquery. Stablecoin issuers such as Tether can block tokens associated with suspected criminal activity because they control the contracts that govern their tokens. That option is not generally available for decentralized cryptocurrencies such as bitcoin or ether in the same way.
Tether and Ledger had not immediately provided CoinDesk with further comment on the freeze, the overall amount stolen or whether Ledger was considering a reimbursement plan for affected customers.
Ledger’s warning to CryptoBilis customers
Ledger has advised customers who bought CryptoBilis devices but have not yet activated them not to set them up. Customers who have already used one of the devices were told to transfer their assets to another device and create a new recovery phrase.
A recovery phrase is the sequence of words used to restore access to a cryptocurrency wallet. Generating a new phrase is intended to ensure that assets are controlled by keys created on a device that is not part of the affected group.
Ledger said every confirmed case involved devices sold by CryptoBilis. That description has drawn criticism because CryptoBilis appeared on Ledger’s website as an authorized reseller. Critics argue that the distribution channel creates questions for Ledger even if the tampering occurred before the devices reached customers.
Ledger has confirmed an unauthorized hardware implant in at least one device, but has not disclosed how the implant was installed, how it operated or whether it transmitted wallet keys. It also has not said that all affected devices contained the same component. The company’s investigation and the work of blockchain analysts are continuing.
The incident is separate from a phishing campaign reported in April. In that earlier case, a fake Ledger Live application appeared on Apple’s App Store and drained at least $9.5 million after users entered their recovery phrases. The CryptoBilis episode appears different because the attacker may have obtained the keys required to empty wallets directly, rather than persuading users to disclose them through a fake application.
Current crypto market picture
Moneyiar market data recorded on October 13, 2026, at approximately 09:33-09:34 +03:30 showed losses across the four listed assets:
- Solana (SOL) traded at $107.059831493, down 4.02% over 24 hours and 10.24% over seven days.
- OriginTrail (TRAC) traded at $0.3967698961, down 0.63% over 24 hours and 4.08% over seven days.
- edgeX (EDGE) traded at $0.337736883, down 6.2% over 24 hours and 25.42% over seven days.
- Horizen (ZEN) traded at $6.2324608834, down 4.43% over 24 hours and 11.19% over seven days.
These figures are Moneyiar data at the stated time and provide a snapshot of market performance, not a measure of the losses tied to the CryptoBilis investigation.
For Ledger customers, the immediate issue is the security status of devices obtained through the reseller. For investigators, the focus remains on identifying affected addresses, following funds and determining how the unauthorized component entered at least one device. Until that work is complete, the figures from blockchain firms remain estimates rather than a confirmed total liability for Ledger or the reseller.
