Ledger called the CryptoBilis hardware wallet attack "limited" in volume, but blockchain analysis shows $102 million drained from 324 Ledger wallets across six networks on October 9, according to on-chain data firm Bitquery. The Ledger wallet maker has not verified the figure or the wallet count.
The gap is wide. Early reports put losses at $86 million. Bitquery's October 13 update raised the total by $16 million after tracing payments through bridge protocols and cross-chain swaps. Ledger's October 13 statement acknowledged fund losses but described the affected device count only as "limited," declining to confirm third-party estimates.
TRON carried 79% of the loss
Bitquery's chain-by-chain breakdown shows the attack hit TRON hardest. The network accounted for $79.3 million across 140 wallets, nearly four times the combined total from the other five chains. Bitcoin came second at $16.8 million from 122 wallets, followed by Ethereum at $3.7 million from 33 wallets.
BNB Chain, Polygon, and Solana together lost $2.28 million. Fifty-eight wallets were drained on multiple EVM chains, which Bitquery counted separately by network but treated as single victims in its 324-wallet total.
Tether froze 10% of stolen funds
Tether froze roughly $10 million in USDT within minutes of the first public alert, blacklisting 37 addresses between 12:09 and 14:10 UTC. The freeze captured about 10% of the stolen stablecoins. Most funds had already moved: Bitquery tracked $20 million bridged to Ethereum and $23.7 million swapped into USDD, which Tether cannot block.
How the implant worked
Ledger's Donjon security team confirmed on October 10 that at least one device sold through Malaysia-based reseller CryptoBilis contained an unauthorized hardware component. The implant sits behind the screen and captures the 24-word recovery phrase as the device displays it during setup. It transmits the phrase over LTE using a provisioned eSIM.
The component does not alter Ledger's Secure Element, operating system, or transaction signatures, which is why the company's Genuine Check tool did not flag it. Researcher Mark Karpelès and Tibane Labs identified two implant variants. The second-generation design fits into the foam padding under the OLED display.
Ledger asked CryptoBilis to halt sales and shipments on October 9. MediaMarkt stopped selling Ledger devices across Europe on October 13. Trezor and OneKey removed CryptoBilis from their reseller lists as a precaution.
The breach comes as the SEC finalizes new custody rules for registered advisers, which include quarterly device-availability checks and annual cybersecurity audits for firms that self-custody client crypto. Hardware wallets remain recommended for offline storage, but the CryptoBilis case highlights supply chain risk as a vector regulators have not yet addressed in detail.
Blockchain records show the drains began at 04:59:57 UTC on October 9, when a single TRON address was added to 30 compromised wallets. The bulk of the transfers occurred between 05:00 and 06:00 UTC. Exchange custody has drawn scrutiny after large-scale reserve declines, but Ledger wallet users now face confirmation that even devices bought through authorized resellers can be compromised before reaching customers.