An investigation into the October 9 wallet-draining incident affecting Ledger hardware wallet users has traced roughly $93.2 million in stolen funds across six blockchains, according to blockchain analytics firm Bitquery. The losses are linked to 315 wallets tied to devices purchased through CryptoBilis, a Ledger reseller operating in Southeast Asia.
Ledger confirmed that one affected user's device contained an unauthorized hardware implant, and said all confirmed cases so far involve CryptoBilis-sold devices. The company said its internal systems and direct sales channels remain unaffected and asked the reseller to suspend sales and shipments while the investigation continues.
Bitquery’s reconstruction puts the estimated losses at approximately $70.5 million on TRON, $16.8 million in Bitcoin, $3.7 million on Ethereum, $1.45 million on BNB Chain, $580,000 on Polygon and $250,000 on Solana. The figure is Bitquery's estimate and has not been independently confirmed by Ledger.
Investigators found signs of coordinated activity, including 25 TRON wallets signing the same approval request within three seconds and small test transactions in the two weeks before the main drain. After the theft, roughly 14.7 million USDT was converted into USDD, a dollar-pegged stablecoin that cannot be frozen through Tether's USDT blacklist. The attacker also moved 2,990 ETH through Tornado Cash on October 9 and 10, and subsequent flows were traced through Zcash and NEAR Intents.
Tether froze about $10 million in USDT across 20 addresses linked to the flows. Bitquery identified another 5.35 million USDC in five addresses that Circle could potentially freeze, though no confirmation of action had been given at the latest update. By around 06:00 UTC on October 11, about $81 million of the stolen assets remained traceable on-chain, down from roughly $88 million the previous day, while approximately 203.8 BTC remained unmoved.
The case highlights both the power and limits of stablecoin freezing. Frozen crypto is not automatically returned to victims, and recovery requires additional coordination, verification and potentially legal proceedings. Binance co-founder Changpeng Zhao alleged attackers may have acquired CryptoBilis and required prior operators to stay silent under an NDA, but that claim has not been independently verified. The incident follows other hardware wallet security problems, including a July Coldcard firmware flaw linked to about 1,816 BTC being drained, then worth roughly $116 million.
