80 Bitcoin Vanished in Ten Days
✦ The Case at a Glance
One victim, 80 BTC
A Bitcoin holder moved 80 Bitcoin onto the hardware wallet Ledger, and not long after, it was all gone, according to reports. The wallet wasn't bought from Ledger directly but from CryptoBilis, a reseller in Southeast Asia.
According to the on-chain analytics firm Bitquery, the 80 BTC arrived in the new wallet on September 29 and was swept out all at once on October 9.
According to the on-chain analytics account Lookonchain, the victim bought 80 bitcoin about four months earlier at roughly $65,000 each, about $5.2 million in total.
Using CoinGecko's October 9 closing price of $82,564 on a UTC basis, 80 BTC comes to about $6.6 million. At a USD/KRW rate in the 1,340-won range, that is about 8.9 billion won.
This was not the loss of a single person. On-chain analysts estimate that hundreds of wallets, centered on wallets bought from the same reseller, were drained, with total losses of around $90 million.
How Did Ledger Respond?
✦ Timeline
In chronological order
On October 9, Ledger said on its official support X account that it had begun investigating. It is looking into reports of fund losses from users in Southeast Asia who bought from CryptoBilis, and it asked the reseller to pause sales and shipments.
It recommended that users who bought from this reseller within the last 90 days not start setup yet, and that those who had already set up their devices consider moving their assets to a new Ledger wallet made with a new seed.
Soon after, it said it had confirmed an unauthorized hardware implant in one of the impacted users' devices. Ledger did not disclose the device model, how the implant works, or how many devices were tampered with.
Ledger told Cointelegraph that its infrastructure, systems, and services were not compromised and that there were no reports of losses from devices bought directly from Ledger.
CryptoBilis was a business listed on Ledger's official reseller list for Indonesia, Malaysia, and the Philippines. After the incident became known, the company halted sales and shipments of every hardware wallet brand it carries.
How Big Is the Damage?
The scale of the damage is not a figure Ledger confirmed but an estimate by on-chain analysts.
✦ Damage Estimates
By on-chain analysts, not confirmed by Ledger
Bitquery's latest tally is about $93.2 million, spanning 315 wallets across 6 chains. Specter put it at more than $86 million, and MistTrack at close to $90 million. The lowest estimate is tanuki42's, at more than $72 million.
There are individual cases too. One wallet was first funded on September 15, and on October 9, 7,001,000 USDT left it. There were also reports that Tether froze about $10 million of USDT linked to the stolen funds across 20 wallets.
According to Bitquery's analysis, part of the stolen funds moved through the mixer service Tornado Cash and on to Zcash. In Bitquery's early tally, 1,254 ETH went into Tornado Cash and was traced to three new wallets holding 384 ETH and 2.1 million USDC.
Bitquery said it linked these by matching amounts and timing, which makes strong evidence but not proof.
How Did It Get Stolen?
What Ledger confirmed is that at least one impacted device was tampered with. How it worked differs from report to report.
✦ Two Accounts of the Tampering
Who said what
One report said the implant reads the recovery phrase shown on the screen when the device is first set up. The explanation is that it targets the single moment when the recovery phrase is visible.
What Ledger officially confirmed goes only as far as the existence of an implant.
Phishing was also floated as a second possibility. The two guesses are that the device was compromised before reaching the buyer, or that users were tricked into handing over sensitive information.
It also came out that the reseller's ownership changed in March this year.
The former founding team said they are no longer part of the company, and the acquisition came with a nondisclosure agreement, so the previous owners could not publicly announce the ownership change.
Investigators, however, found no direct evidence linking the ownership change to the tampering of the devices.
It Has Happened Before
A wallet being tampered with on its way through a seller is not new.
A fake Trezor Model T sold on an online classifieds site in March 2022 was later analyzed by Kaspersky, which published its findings in May 2023: the microcontroller and software had been tampered with so that a recovery phrase the attacker already knew would be used at initial setup.
The look and screen were the same as the genuine one.
In January 2026, there was also an incident at Ledger's payment provider Global-e in which customers' names, contact details, and order information were leaked.
That time it was customer data that leaked, not devices, and birth dates, credit card information, and the 24 recovery words were not leaked.
If You Already Own a Ledger
✦ Check Your Ledger
Three things to look at
Whether your device is affected starts with where you bought it. Check whether CryptoBilis appears in your order history or receipt. Ledger's first recommendation targeted users who bought from CryptoBilis within the last 90 days.
If a recovery phrase or PIN was already written down when you first received it, Ledger's official guidance is not to use that device. Ledger does not give out a PIN or recovery phrase with the product, and it never asks for one.
The genuine check in Ledger Wallet (formerly Ledger Live) has limits too. Ledger's official Academy says this check cannot catch physical tampering such as spy implants if the original Secure Element remains intact.
Passing the genuine check does not mean there is no tampering.
If you already set up a device bought from CryptoBilis and are using it, Ledger's advice was to consider moving your assets to a new Ledger signer made with a new seed.
That means not reusing the old recovery phrase, but using the new private keys and the new 24-word recovery phrase created when you set up the new device.
Where Should You Buy a Wallet?
✦ Normal vs. Red Flags
The criteria Ledger gave
Ledger's guidance is simple. A genuine device never arrives with a recovery phrase already written down.
Pre-seeded devices, counterfeits, and opened packaging also turn up on places like Amazon, so Ledger tells people to buy from the official Ledger store or an authorized reseller.
What stands out about this incident is that CryptoBilis was on the authorized reseller list. A problem came from a device bought from a business you could trust. There are still no reports of losses from devices Ledger sold directly, but the unease is real.
✦ Bitcoin Closing Prices
CoinGecko, UTC basis
How did the Bitcoin price do? On a CoinGecko UTC basis, the October 8 close was $81,686, the October 9 close, when the incident became known, was $82,564, and the October 10 close was $82,918.
A distribution accident at one hardware wallet company did not cause a noticeable shock to the price. That's a relief.
This is not investment advice. You know that, right? Let's protect our precious money ourselves.
Well then, shall we begin today's adventure?
✦ Related Posts
US Inflation Below Forecasts (August PCE): Stocks and Bitcoin Rise
Jobs Shock, Yet the Nasdaq Hits a Record?
Subpoenas Fly Ahead of New York City's AI Hearing
No comments:
Post a Comment