Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chains
Bitquery estimates $102 million was drained from 324 Ledger-linked wallets on six chains, up from about $86 million earlier. Ledger says its chips, software and servers were not breached and calls it a distribution-channel attack.
The Investor · Invest desk
A share bar: $10 million in USDT that Tether froze, out of Bitquery's $102 million estimate, about 9.8%.
- Reported USDT Tether has frozen, claim 15 $10 million of $102 million 9.8%
Reported USDT Tether has frozen The rest of the 102
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| Reported USDT Tether has frozen | $10 million | $102 million | 9.8% | 15 |
What happened
- On Ledger's account, criminals bought genuine devices, hid components inside and returned them to Southeast Asian channels, and the implants read 24-word recovery phrases during installation.
- Bitquery says the affected devices came through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines.
- Chainalysis found that a task-scam operator who moved proceeds into three Ledger wallets on September 22 lost more than 60 Bitcoin, about $4.8 million, on October 9.
- Bitquery also traced coordinated fund movements, including $10 million in USDT that Tether has frozen, with other assets passing through Tornado Cash and THORChain.
Why it matters
- Who's exposed exposure For a buyer holding a tampered device, a recovery phrase copied at installation was exposed from the first minute, and no later storage habit changes that.
- Who has to decide decision Buyers and wallet makers now have to decide which sellers they trust, since the loss sits in who sold the device and two competing makers have already acted on resellers.
- What doesn't add up contradiction Ledger's statement that its own chip, software and servers were intact and Bitquery's loss estimate can both stand, so a no-breach statement from a maker says little about whether a particular device is safe.
Next story · Invest · 3d ago
Ledger finds a cellular implant inside a CryptoBilis-sold signer that copies recovery phrases at setupConfirmed8 publishers
The estimate is still moving. The revision from about $86 million to $102 million added $16 million, an 18.6% rise on the earlier count [20][13], and Ledger has not determined an overall loss number of its own [21]. Spread across 324 wallets, the figure is a mean of about $315,000 a wallet [12].
We think the reading that self-custody itself failed is half right. In its October 15 post, Ledger said none of its chip, operating system or servers had been breached [2]. What failed was the step before the owner's own handling began: a recovery phrase copied at installation was never private, whatever the owner did with the paper afterwards [3]. The assumption to revisit is that the device generating the keys is the device the maker shipped.
The counter-thesis is a narrow one. Bitquery traces the affected devices to a single reseller [4]. If every affected device traces to that reseller and no implanted unit turns up in stock sold elsewhere, the case for a broad rethink is weak and we are wrong. Two other outcomes would also change the view: Ledger's own total landing far from Bitquery's, or an implanted device from a second maker.
The task-scam operator's roughly $4.8 million is 4.7% of Bitquery's total [14], and Cryptopolitan notes the loss does not mean the operator's own victims recovered anything [5]. Tether's $10 million freeze covers 9.8% of the same total [15][8].
The closest base rate is TRM Labs' first-half count of 207 attacks and $972 million stolen [10]. Infrastructure and operational breaches were 15% of incidents but 76% of losses [11]. That works out to about 31 incidents and $739 million [16][17], an average near $23.8 million [18], against roughly $1.3 million for each of the other 176 [19]. The Ledger theft falls outside that half-year, and Cryptopolitan does not say how TRM would classify it.
The fixes reported so far act on sellers. Ledger told authorized resellers to stop displaying the device publicly and to hand it over only at the time of purchase [6]. OneKey parted ways with CryptoBilis, and Trezor will cancel certain resellers' authorizations starting January 1, 2027 [7], 78 days after Ledger's October 15 post [9]. A device already sold is outside all three.
What to watch
- Ledger publishing its own loss total to set against Bitquery's estimate, which has already moved once.
- Any implanted device found outside the CryptoBilis channel, since one would widen this beyond a single reseller.
- Whether other wallet makers set cutoff dates for resellers of their own, as Trezor has for January 1, 2027.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+12
- Incentives55
- Confidence60
Perspective Coverage
6 publishers- Builder
- Builder 23%
- Operator
- Operator 44%
- Investor
- Investor 33%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Chainalysis found that a task-scam operator moved proceeds into three Ledger wallets on September 22 and lost more than 60 Bitcoin, about $4.8 million, when the coins were moved on October 9 to a wallet already known to be used for stolen funds.
- [2]
Ledger said in its October 15 post that its chip, operating system and servers were not compromised, describing the incident as a distribution-channel attack on devices sold through reseller CryptoBilis.
- [3]
According to Ledger's statement, criminals bought genuine devices, hid components inside them and put the tampered devices back into Southeast Asian distribution channels; the implants could retrieve 24-word recovery phrases during installation, letting criminals access the wallets remotely.
- [4]
According to Bitquery, the affected devices were obtained via CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines.
- [5]
The task-scam operator's loss does not imply that the original scam victims recovered their money.
- [6]
Ledger advised authorized resellers to stop displaying the device publicly and to give it only at the time of purchase.
- [7]
Trezor will cancel authorizations from certain resellers starting January 1, 2027, and OneKey decided to part ways with CryptoBilis.
- [8]
Bitquery's investigation found coordinated movements of stolen funds, including $10 million in USDT that Tether has since frozen; other stolen assets were traced through Tornado Cash and THORChain.
- [9]
January 1, 2027 is 78 days after Ledger's October 15 post.
- [10]
According to TRM Labs, hackers carried out 207 attacks in the first half of 2026, stealing $972 million.
- [11]
Infrastructure and operational breaches made up 15% of the first-half 2026 incidents but 76% of total losses.
- [12]
$102 million across 324 wallets is a mean of about $315,000 a wallet.
- [13]
The revision from about $86 million to $102 million added about $16 million, an 18.6% rise.
- [14]
The task-scam operator's roughly $4.8 million is about 4.7% of Bitquery's $102 million estimate.
- [15]
The $10 million of USDT Tether froze is about 9.8% of Bitquery's $102 million estimate.
- [16]
Infrastructure and operational breaches account for roughly $739 million of the $972 million stolen in the first half of 2026.
- [17]
Infrastructure and operational breaches were about 31 of the 207 incidents.
- [18]
The average infrastructure or operational incident cost about $23.8 million.
- [19]
The other 176 incidents averaged roughly $1.3 million each.
- [20]
Bitquery estimates $102 million drained from 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon, up from about $86 million previously.
- [21]
Ledger has not yet determined an overall loss number.
Sources
6 independent publishers whose own reporting we read for this story.
- coindesk.comScammer gets scammed in Ledger spy-chip exploit, loses almost $5 million in bitcoin
1 article · October 16, 2026
- cointelegraph.comScammer loses $4.8M stored on tampered Ledgers: Asia Express
1 article · October 15, 2026
- cryptobriefing.comLedger supply-chain attack drains over 60 BTC from wallet tied to alleged crypto scammer
1 article · October 15, 2026
- cryptopolitan.comTask-scam operator loses $4.8M in Bitcoin to Ledger implant theft
1 article · October 15, 2026
- decrypt.coScammer Lost $4.8M in Bitcoin to Tampered Ledger Wallets: Chainalysis
1 article · October 16, 2026
- news.bitcoin.comLedger Thieves Might Have a New Big Problem—Stealing From Criminals
1 article · October 16, 2026
Topics and entities
Topics
- Self-custody
- Hardware Wallet Security
- Crypto theft and hacks
- Software supply chain attacks