Suspected Ledger wallet thefts near $90 million under investigation as buyers from reseller CryptoBilis report losses

Ledger's remedy tells you more than its statement does. In its Oct. 9 statement the company said it was investigating losses among CryptoBilis buyers ^[4]. It told anyone who bought from that reseller in the past 90 days to leave unopened devices uninitialized, and urged those already using one to consider moving their crypto to a new Ledger set up with a fresh recovery phrase ^[6]. A company that suspected its own Secure Element or key-generation code would be unlikely to tell victims to buy another unit of the same product. The advisory covers one seller and about a quarter's worth of its sales ^[6].

The seller is an authorized one. CryptoBilis appears in Ledger's official reseller directory for Malaysia, Indonesia and the Philippines, and buying through such a listing is how customers usually guard against counterfeit or compromised hardware ^[7]. Ledger's security documentation says Genuine Check verifies the Secure Element but cannot necessarily detect physical modifications elsewhere in the device if the original chip is intact. A unit altered between the factory and the buyer could pass ^[10].

Changpeng Zhao, the Binance founder, wrote on X: "Based on information so far, it seems to be localized to a supply chain attack with one vendor." ^[8] Mark Karpeles, the former Mt. Gox chief executive, has asked CryptoBilis to open unsold wallets so their circuit boards can be checked for spying implants ^[9]. No confirmed evidence shows that implants caused the thefts. Ledger has not disclosed how many devices may be compromised, or whether the cause was counterfeit hardware, physical tampering or some other attack ^[11].

More than one explanation fits the record. If Karpeles finds added components on genuine boards, the limit of Genuine Check becomes the central fact. Every device that passed through a third party before reaching its owner would then carry the same exposure in principle ^[10]. If the devices were counterfeits, the question becomes how fakes got into an authorized reseller's stock. The third possibility is that the tally lumps separate thefts together. On-chain investigator Specter counted inflows from hundreds of suspected victim wallets into addresses on Bitcoin, Ethereum and Tron and first put the total above $86 million ^[12]. MistTrack later put it closer to $90 million ^[13]. The two figures are about $4 million apart, or roughly 5% ^[16]. Neither has been independently verified, and investigators have not established that every wallet in the count fell to the same operation ^[15].

The one recovery route on record is Tether's. MistTrack said it saw Tether freezing USDT linked to the incident ^[1]. Frozen USDT cannot move through ordinary transactions until the restriction is lifted ^[2]. Investigators have not determined how much of the money can be recovered ^[14].

I think the evidence points to a compromised channel more than a broken wallet, mainly because Ledger drew its own advisory so narrowly. That view is wrong if victims turn up who bought directly from Ledger or from other resellers. It is also wrong if the cause turns out to be in the firmware or the Secure Element. In either case a notice limited to one vendor and 90 days would be too small. Investigators still have not determined how the wallets were compromised ^[14].