CryptoBilis Wallet Breach Hits Over $93M

• On-chain intelligence providers estimate the theft from wallets tied to hardware devices distributed by authorised Ledger reseller CryptoBilis at between $93.2 million and $94.5 million, though the manufacturer has issued no official loss figure.
• Tether blocked $10 million in USDT connected to the incident after Ledger confirmed that at least one compromised device contained an unauthorised hardware component.
• The manufacturer instructed CryptoBilis purchasers to leave unopened devices untouched and move holdings from active units to freshly initialised hardware with new recovery phrases.

Traced flows reach $93 million across multiple chains

Bitquery identified $93.2 million in assets linked to the CryptoBilis compromise, reporting that attackers drained 315 wallets spanning six blockchains and targeted primarily USDT and TRON tokens. YFarmX placed the figure higher at $94.5 million taken from 521 addresses across seven networks. Both assessments derive from public ledger records rather than any confirmed total from Ledger, which continues its investigation three days after initial reports surfaced Sunday.

Stablecoin issuer intervenes with $10 million freeze

Tether froze $10 million in USDT tied to the stolen funds, a step unavailable for non-custodial assets such as bitcoin or ether. Bitquery noted that roughly $81 million remained traceable on-chain as of Oct. 11, while portions had already passed through Tornado Cash and Zcash. The issuer did not respond to requests for comment on the blacklist action.

Unauthorised implant discovered in returned device

Ledger confirmed the presence of an unauthorised hardware implant in at least one affected unit but declined to specify whether the same tampering method applied to the wallet from which funds were stolen or to describe the modification technique. The company has not replied to questions regarding the total amount missing or any potential reimbursement scheme for victims.

Reseller channel sparks accountability debate

Ledger's framing of the breach as a CryptoBilis-specific problem has met resistance because the Southeast Asian distributor appeared on the manufacturer's official list of authorised sellers. X user MyCryptoParadise challenged the characterisation directly, writing that responsibility lies with Ledger rather than the reseller and urging the firm to accept ownership of the failure.

Distinct attack vector from earlier phishing wave

The current episode differs from an April campaign in which a counterfeit Ledger Live application on Apple's App Store collected user recovery phrases and drained at least $9.5 million. This time the attacker appears to have obtained private keys directly, enabling the systematic emptying of hundreds of wallets without relying on social engineering.

Manufacturer issues device-handling guidance

Ledger told CryptoBilis customers to avoid initialising any unused hardware and advised current users to migrate assets immediately to a separate device initialised with a freshly generated recovery phrase. The guidance aims to isolate potentially compromised units from any further exposure while the forensic review proceeds.