Ledger investigates theft tied to CryptoBilis-sold wallets as $93M is traced
In brief
- Bitquery traced $93.2 million taken from 315 wallets across six blockchains
- YFarmX estimated $94.5 million taken from 521 addresses across seven blockchains
- Tether froze $10 million in USDT tied to the theft, Bitquery confirmed
- Ledger confirmed an unauthorized hardware implant in at least one affected device
- CryptoBilis was listed as an authorized reseller on Ledger's website, critics noted
What the trackers found
Bitquery said it traced $93.2 million linked to the Ledger exploit, with the hackers taking mostly USDT and TRON tokens from 315 wallets across six blockchains. Security research platform YFarmX put the figure higher, at $94.5 million from 521 addresses across seven blockchains.
Both estimates come from public blockchain data. They aren't a confirmed Ledger loss total.
Bitquery said roughly $81 million could still be traced onchain as of Oct. 11 (some funds had already moved through Tornado Cash and Zcash). It also confirmed Tether's $10 million USDT freeze. Stablecoin issuers can block tokens linked to crime, which isn't possible with bitcoin or ether. Tether didn't immediately respond to CoinDesk's request for comment on the freeze.
Ledger points to the reseller
Ledger confirmed an unauthorized hardware implant in at least one affected device. It didn't say whether the stolen wallet was compromised the same way, or how the devices were tampered with. The company also didn't immediately respond to CoinDesk's request to confirm the amount stolen or say whether it's considering a reimbursement plan.
Its advice to CryptoBilis customers was simple. Don't set up unused devices, and if you've already used one, move assets to a new device with a newly generated recovery phrase.
This isn't the same as the April phishing campaign, when a fake Ledger Live app on Apple's App Store drained at least $9.5 million after users entered their recovery phrases. This time, the attacker appears to have obtained the keys needed to empty hundreds of wallets directly.
"A Ledger incident"
Ledger's effort to describe the incident as limited to CryptoBilis drew pushback, because Ledger's own website listed the reseller as authorized.
“It’s not a CryptoBilis incident, it’s a Ledger incident” (X user MyCryptoParadise)
That's one critic's view, not an established finding.
Ledger said on Sunday that its investigations, which began after the theft was first reported three days earlier, are still underway.
Frequently asked questions
How much crypto was stolen in the Ledger CryptoBilis exploit?
Bitquery said it traced $93.2 million taken from 315 wallets across six blockchains, mostly USDT and TRON tokens. YFarmX estimated $94.5 million from 521 addresses across seven blockchains. Both figures are based on public blockchain data and aren't a confirmed Ledger loss total.
What did Ledger tell CryptoBilis customers to do?
Ledger told CryptoBilis customers not to set up unused devices. Customers who had already used a device were told to move their assets to a new device with a newly generated recovery phrase.
Have any of the stolen funds been frozen?
Tether froze $10 million in USDT tied to the theft, which Bitquery confirmed. Tether didn't immediately respond to CoinDesk's request for comment. Bitquery said roughly $81 million could still be traced onchain as of Oct. 11, though some funds had moved through Tornado Cash and Zcash.
