Ledger CryptoBilis hack drains up to $93 million from Southeast Asian hardware wallets

Owners of Ledger hardware wallets in Southeast Asia woke up on Friday, October 9, to find their crypto gone. The Ledger CryptoBilis hack, named after the reseller that sold the affected devices, drained somewhere between $72 million and $93 million in a single morning, depending on which blockchain analyst you ask. Ledger says it is investigating, has told the reseller to stop selling, and is urging recent buyers not to set up their devices at all.

For anyone who keeps savings in a hardware wallet, this is the nightmare scenario. These devices exist precisely so that your keys never touch an internet connected computer. Here is what we know so far, what is still unclear, and what you should do if you own a Ledger.

What happened on October 9

According to an onchain investigation published by Bitquery, the draining started at 05:07 UTC on Friday, when wallets on the Tron network began signing approvals. Within roughly six seconds, about $29 million had been pulled out. Less than an hour later, 111 Bitcoin wallets were emptied in a single block.

Bitquery counts $92.9 million taken from 311 wallets spread across Tron, Bitcoin, Ethereum, BNB Chain and Polygon. Most of the money, about $70.5 million, was USDT on Tron. Another $16.8 million came out of Bitcoin wallets, equal to 203.8 BTC. Earlier estimates were lower because they only tracked a handful of public addresses. CryptoTicker, which compiled figures from several researchers, cited estimates of more than $86 million from Specter, more than $72 million from tanuki42 and nearly $90 million from MistTrack. None of those numbers has been confirmed by Ledger.

The theft does not look improvised. Bitquery traced the attacker's funding back to a Bybit withdrawal on September 24. The thief's control addresses received their first funds the next day, and from September 26 to October 7 the attacker ran dozens of small test transactions on Tron and Ethereum before striking.

What Ledger has said

Ledger posted its first statement at 13:32 UTC on Friday, according to CryptoTicker. The company said it was looking into losses among users in Southeast Asia who had bought devices from CryptoBilis, a reseller that serves Indonesia, Malaysia and the Philippines. Ledger asked CryptoBilis to pause all sales and shipments.

The company's advice was blunt. If you bought from CryptoBilis in the past 90 days and have not set the device up, don't. If you already set it up, move your assets to a new Ledger with a new seed phrase.

Ledger has not said how the keys leaked. It has not confirmed the loss total, and it has not accused the reseller of wrongdoing. Bitquery also notes that how the keys were exposed remains unknown.

How the Ledger CryptoBilis hack may have worked

Because Ledger itself does not appear to have been breached, attention has shifted to the supply chain. That means the path a device takes from the factory to a customer's hands.

The hidden chip theory

Mark Karpelès, the former head of the Mt. Gox exchange, has described one possible method, according to CryptoTicker: a small implant hidden inside the casing that reads the screen, records the 24 word recovery phrase when the device displays it during setup, and sends it out. A device altered this way could reportedly still pass Ledger's genuine device check, and the only way to spot it would be to open the case.

This is a theory, not a confirmed finding. Nobody has publicly shown a tampered CryptoBilis unit yet.

The phishing theory

Other researchers point to a simpler explanation for at least some victims. A fake Ledger website was reportedly ranking high in Google search and asking visitors to type in their seed phrase. Anyone who did that handed their keys to a stranger, no hardware tricks required. There is no confirmed link between that site and the October 9 losses, though, and the tightly timed drain across hundreds of wallets suggests the attacker had collected keys well in advance.

It is also not known whether the reseller knowingly sold altered devices, had a rogue insider, or was itself supplied with counterfeit goods.

Where the money went

The attacker moved fast to make the funds harder to seize. Tether, which issues USDT, froze 37 linked addresses holding about $10 million, according to Bitquery. But a large share of the stolen USDT was swapped into USDD, a different stablecoin that Tether cannot freeze. Bitquery put about $15.1 million in USDD as of its data cutoff on Friday afternoon.

Some of the stolen ether went into Tornado Cash, the coin mixer. Bitquery counted 1,254 ETH sent there in three batches, worth about $3.12 million. The $16.8 million in Bitcoin had not moved at the time. In total, Bitquery estimates about $79 million is still sitting onchain, which leaves some room for future freezes or recovery efforts.

Why it matters

Hardware wallets are the standard advice for anyone holding meaningful amounts of crypto. Our guide on how crypto wallets work recommends them for exactly that reason. This incident does not break that advice, but it sharpens it: a hardware wallet is only as trustworthy as the place you bought it.

It also lands at an awkward moment for the industry. Security worries were already running high after an Ethereum researcher urged holders to adopt a crypto bunker mode to protect wallet keys. A reseller level attack is a reminder that the weakest link is often not the cryptography. It is people, packaging and shipping.

Binance founder Changpeng Zhao called it a supply chain attack at one vendor and suggested testing any new hardware wallet with small amounts for a few weeks, CryptoTicker reported. That habit helps against some problems, but it would not stop an implant that captures the seed at setup and waits.

Who is affected

Based on what Ledger has said, the people at risk are customers who bought from CryptoBilis, especially in the last 90 days. There is no indication so far that devices bought directly from Ledger are involved. Bitquery's count of 311 drained wallets suggests the victims are a relatively small group with large balances, not a broad attack on all Ledger owners.

What to do right now

If you own a Ledger, start by figuring out where it came from.

• Bought from CryptoBilis and not set up yet: leave it in the box and contact Ledger support.
• Bought from CryptoBilis and already in use: treat your seed phrase as compromised. Buy a new device directly from the manufacturer, create a fresh seed, and move your funds as soon as you can.
• Bought secondhand, from a marketplace or at a suspicious discount: apply the same caution, at least for larger balances.
• Bought directly from Ledger: nothing suggests you are affected, but check that your device generated its own seed and that no recovery words came preprinted in the box.

Never type your seed phrase into a website, app or form. A real wallet maker will never ask for it. Our guide to spotting a crypto scam covers the most common tricks.

If you already lost funds, save the transaction hashes and addresses, contact the SEAL 911 security group, file a police report and, if USDT was taken, notify Tether. For large holdings, consider a multisig setup that spreads signing across devices from different makers, so one compromised wallet cannot empty everything.

What to watch next

The big open question is the method. If researchers find implants inside CryptoBilis devices, every hardware wallet maker will face pressure to improve tamper detection and tighten control over resellers. Watch for Ledger's full findings, any further Tether freezes, and whether authorities in Indonesia, Malaysia or the Philippines get involved.

For more coverage of wallet security and the stablecoins at the center of this theft, see our explainer on how stablecoins hold their value and the latest on our crypto news page.

Frequently asked questions

Was Ledger itself hacked?

There is no evidence of that so far. Ledger has tied the losses to customers who bought from one reseller, CryptoBilis, and the cause is still under investigation.

How much was stolen in the Ledger CryptoBilis hack?

Estimates range from about $72 million to $92.9 million. Bitquery's count of $92.9 million from 311 wallets is the highest published figure. Ledger has not confirmed a total.

Is my Ledger safe if I bought it from Ledger's website?

Nothing reported so far points to devices sold directly by Ledger. Still, confirm that your device created its own recovery phrase and never share that phrase with anyone.

Can the stolen crypto be recovered?

Some of it may be. Tether froze about $10 million, and Bitquery estimates around $79 million was still onchain on Friday afternoon. Funds swapped into USDD or sent through Tornado Cash are much harder to trace and seize.