Bitquery Estimates $93.2 Million Loss from Ledger Users Attack

Bitquery has estimated that approximately $93.2 million was stolen from 315 cryptocurrency wallets across six blockchains, primarily affecting users of Ledger devices purchased from CryptoBilis, a Southeast Asian reseller.

This figure comes after an initial report by a researcher known as Specter, who on October 9 indicated that over $86 million might have been stolen from Ledger holders. Bitquery's analysis of transactions on networks including TRON, Bitcoin, Ethereum, BNB Chain, Polygon, and Solana revealed additional movements of funds not accounted for in the original assessment.

Of the total losses, the majority, about $70.5 million, was withdrawn from the TRON network, followed by approximately $16.8 million from Bitcoin. Other amounts included:

• $3.7 million from Ethereum;
• $1.45 million from BNB Chain;
• $580,000 from Polygon;
• $250,000 from Solana.

Bitquery's calculations only considered assets that left the victims' wallets, excluding subsequent exchanges or movements by the hacker. The company based its estimates on cryptocurrency prices from October 9.

YFarmX reported that 530 wallets were affected, with total losses reaching $103.4 million.

The Attack Spanned Multiple Networks

The hacker began withdrawing funds on October 9, depleting wallets across six blockchains in just 47 minutes. In Bitcoin, 111 addresses were emptied in a single block, while on TRON, 25 wallets approved identical USDT transfers within three seconds.

After receiving permissions, the attacker quickly withdrew around 29 million USDT. Additionally, 30 wallets on TRON had transferred control over their assets to a new key shortly before the attack, leading to further withdrawals totaling approximately $5.8 million.

Researchers found that at least 21 test transactions were conducted on TRON and 20 on Ethereum in the two weeks leading up to the attack, suggesting the hacker may have been testing the system.

Ledger's Response

Ledger has linked the compromised devices to CryptoBilis, which was identified as an authorized seller in Indonesia, Malaysia, and the Philippines. On October 9, the company requested CryptoBilis to halt sales and shipping of devices.

Customers who purchased Ledger devices from this reseller in the past 90 days were advised not to set up their wallets. Those who had activated their wallets were recommended to transfer their assets to another device with a new seed phrase.

Ledger assured that its own infrastructure and systems were not compromised, and reported no issues with devices purchased directly from the manufacturer. However, on October 10, the company did discover an unauthorized hardware implant in one of the affected devices, although it has not confirmed similar findings in all related devices.

Details on the Hardware Implants

Tibane Labs provided further context, examining two Ledger Nano X devices with suspected hardware implants. These components could intercept information between the secure chip and the device's display, potentially capturing the 24-word seed phrase during initial setup.

It was noted that the devices analyzed were not confirmed to have been sold through CryptoBilis, as one was purchased on Yahoo! Auctions in Japan and the other from a third-party seller on Amazon Japan, with the latter's shipment originating from Malaysia.

Tibane Labs also reported that former co-founders of CryptoBilis claimed to have transferred the business to new owners in March 2026, losing access to its systems thereafter.

Freezing of Stolen Funds

Tether has frozen 37 addresses linked to the attack, with around $10 million in USDT across 20 of those addresses. However, the freeze does not guarantee automatic reimbursement to the victims.

The hacker attempted to obscure the movement of assets through various bridges and exchange services, including USDT0, Chainflip, and Tornado Cash, with approximately 2,990 ETH being laundered through Tornado Cash.

Additionally, about $14.9 million was converted into USDD, a stablecoin that Tether cannot freeze. Subsequently, some of these funds were converted back into USDT and exchanged for ETH.

As of October 11, Bitquery reported that approximately $86 million of the stolen funds could still be traced on the blockchain, although the hacker continued to move assets, including USDC withdrawn on October 11 and 12 before a potential freeze by Circle.

Recommendations for Ledger Users

Users who purchased devices through CryptoBilis are advised to:

• avoid using unactivated wallets from this reseller;
• transfer assets to another wallet with a new seed phrase;
• refrain from using Ledger if the 24 words were printed or included in packaging;
• check wallet permissions in a blockchain explorer;
• ask senders to stop transfers to compromised addresses.

Bitquery warns that if the hacker obtained the private key, they could access not only current assets but also any future funds sent to the compromised wallet.

The cause of the wallet compromise remains unclear, with only one confirmed hardware implant found, and on-chain analysis indicates the effects of the attack without revealing how keys were obtained from other users.

In September, losses from hacks in the crypto industry exceeded $768 million, marking the worst month of the year, according to PeckShield.