Ledger CryptoBilis Theft Hits $102M, Bitquery Estimates

CryptoBilis loss estimate expands to six chains

Bitquery’s 14:00 UTC update added nine previously missed TRON wallets drained of 8.8 million USDT on October 9. Its six-chain tally counts victim outflows, excluding subsequent swaps and transfers between attacker wallets.

The firm reported $10 million in USDT frozen by Tether across 20 holding addresses. Frozen tokens are not refunded funds. Its wallet tally also does not identify 324 separate people or devices.

Earlier, Lookonchain reported that one buyer lost 7 million USDT after purchasing a device three weeks before the drain. Such individual reports illustrate the scale of exposure but cannot independently establish the total number of affected customers.

The higher estimate reflects newly identified October 9 thefts, rather than proof of a new October 12 attack wave. Bitquery also corrected an earlier routing claim: addresses it had grouped together were THORChain vaults, and it withdrew a Binance payment lead.

Those revisions underscore the difference between observing a transfer and identifying its beneficiary. A service address can process unrelated customers’ money, so proximity in a transaction trail alone cannot establish that every subsequent payment belongs to an attacker.

Hardware-wallet incidents have previously required similar distinctions between technical findings and observed losses, including the Coldcard investigation’s later theft accounting. That comparison does not establish a shared attacker or vulnerability in the CryptoBilis case.

The monetary estimate should therefore be read alongside the company’s narrower confirmed finding. Neither the loss calculation nor the existence of an implant in one device settles where tampering occurred, who performed it, or which other units require examination.

Ledger Genuine Check has a physical limit

Ledger’s Donjon genuineness documentation says its software check authenticates a device’s Secure Element, the chip used to protect sensitive information. It cannot detect unauthorized physical modifications, including spying implants, if that original chip remains intact.

The check uses a cryptographic challenge and response to verify authenticity. That tests whether the chip can provide the expected proof; it does not reconstruct every stage of shipping, warehousing or reseller handling.

The documentation also warns that packaging seals can give false reassurance because they can be copied or packages opened without obvious damage. Consequently, an intact box and a successful authentication result answer different questions from whether additional hardware has been installed.

Ledger has not publicly supplied a complete forensic account of the implant’s operation in the statements reviewed for this article. The confirmation should not be expanded into a claim that its cryptographic chip was broken or that every compromised wallet was affected through the same mechanism.

In its October 11 update, Ledger described the volume of impacted devices as limited and said it was working with relevant authorities. That description did not include a numerical device count in the publicly retrieved statement.

Cointelegraph reported that Ledger said its infrastructure, systems and services were not compromised. The company also said the incident appeared isolated to the reseller and its market, while leaving the investigation open.

That is the company’s current assessment, rather than an independently completed audit of every sales channel. Evidence about the reseller’s inventory and individual customer devices remains central to establishing the incident’s boundaries.

Ledger buyers face a new-seed decision

Ledger’s advice, reported by Cointelegraph, is for recent CryptoBilis buyers to avoid setting up unused devices and, if already set up, consider moving assets to a new Ledger signer with a new seed. CryptoBilis had stopped sales of its hardware-wallet inventory pending the investigation, the report said.

A seed, or recovery phrase, is the backup from which wallet keys are recreated. Ledger’s explanation of recovery phrases makes clear that someone possessing those words can regain control of the associated accounts.

Restoring the same phrase on another device therefore reproduces the same keys. It replaces hardware without removing another person’s possible knowledge of the wallet secret, a distinction that makes the new-seed instruction consequential.

Ledger’s compromise-response guidance separates malicious token approvals from private-key or seed exposure. It recommends moving remaining assets to accounts generated from a different recovery phrase when that underlying secret is compromised.

Revoking an approval addresses a permission granted to spend a token. It cannot make a stolen private key secret again. A recovery plan must match the established failure, rather than assuming that a routine app update or permission change resolves physical tampering.

Customers also face impersonation risk during a fast-moving investigation. Ledger’s phishing warnings say support will never request recovery words and direct users to official channels. That concern connects to prior fake wallet-app and sniffer coverage, without establishing those scams as this incident’s cause.

Alternative.me’s index read 69, classified as Greed, versus 61 a day earlier. It measures broader market sentiment, not confidence in a particular wallet.

As of 19:05 UTC on October 12, the reviewed disclosures did not establish a final company-confirmed loss total, device count, full implant mechanism or reimbursement plan. The next consequential developments are a forensic explanation, a clearly defined affected inventory range and confirmed recovery arrangements.