CZ警告：在8600万美元Ledger黑客事件后存在无形威胁

Ledger users suffered losses of more than US$86 million, suspected supply chain attack

On October 9, 2026, some Ledger users suffered financial losses of more than US$86 million on Bitcoin, Ethereum and Wave Field networks. Binance founder Zhao Changpeng (CZ) believes the thefts originated from supply chain attacks related to a single seller. Currently, Ledger is conducting an investigation, and the specific reason has not yet been confirmed.

Incident summary

• Approximately US$86 million was stolen from Ledger users.
• Ledger is investigating losses reported by buyers of CryptoBilis channel products in Southeast Asia and has requested a suspension of sales in the channel.
• Zhao Changpeng (CZ) pointed out that this was a supply chain attack.
• Tether froze USDT worth $1.45 million, but lifted it three hours later.

Ledder hack: History and loss details

On October 9, 2026, Ledger announced that it was investigating financial losses incurred by users in Southeast Asia who purchased its hardware wallets through reseller CryptoBilis. Analyst Specter estimates that losses involving Bitcoin, Ethereum and wavefields total more than $86 million. As of now, Ledger has neither confirmed the cause of the accident nor announced the number of equipment affected.

Where does the money flow?

Data platform Arkham classified 152 addresses as "ledger-drainer"(Ledger Scavengers), and the total value of these wallets is approximately $71.6 million. Arkham's tracking data shows that funds also flowed to multiple other addresses, with individual outflows ranging from $500,000 to $4 million.

Comparison of three-party data:

Specter said the loss exceeded US$86 million;MistTrack estimated the loss at nearly US$90 million; and Arkham showed it at US$71.6 million. The difference stems in part from the difference in statistical scope, as screenshots accompanying Specter's post showed another Arkham entity worth approximately $87 million. It's like three watches don't show exactly the same time: they describe the same event, but record slightly different moments.

Note: The "ledger-drainer" entity contains 152 addresses, and the data was intercepted from October 9, 2026. Source: Arkham.

Tether's reaction:

According to MistTrack, the issuer Tether froze USDTs at addresses related to the theft. It should be noted that this is different from the freezing incident that occurred in THORChain on the same day. About $1.45 million in USDT was locked in ThorChain's Tron vault at the time, but was released about three hours later. Tether did not explain the reasons for the second freeze, and there is currently no evidence to link it to the theft.

How does Zhao Changpeng (CZ) view the Ledger wallet hacking incident?

On October 9, 2026, Zhao Changpeng (CZ) expressed his view on Platform X (formerly Twitter) that the theft seemed to be limited to a supply chain attack against a single seller. Such attacks often involve tampering with products before they reach customers. Here are his main points:

Based on available information, this looks like a localized supply chain attack involving a single seller. There may be only a few people who purchased counterfeit Ledger equipment (or tampered Ledger equipment).

There are still three possibilities:

1. Counterfeit products: A fake device that imitates the appearance of Ledger.
2. Physical modifications: Additional components have been added or modified to real equipment.
3. Mnemonic leak: Third parties are aware of the recovery phrase, regardless of the reason.

In another message, CZ advised users to wait several weeks before placing large amounts of money in new wallets. However, threats are not always obvious. According to Ledger's documentation on "Genuine Check", Genuine Check cannot detect physical modifications as long as the original chip remains intact, but it can still effectively prevent counterfeit products.

Mt. Former Gox CEO Mark Karpelès showed off on the X platform a Ledger device he claimed had been modified that contained an implant. According to him, the device can read the screen and get recovery phrases during the setup process. He also called on CryptoBilis to unpack the equipment in inventory. However, there is currently no evidence that the device came from CryptoBilis, nor is there any evidence that the implant explained the theft. In addition, no sources indicate how long the funds disappeared after the purchase.

Ledger's advice to CryptoBilis buyers

On October 9, 2026, Ledger customer service requested CryptoBilis to suspend sales and shipments of all Ledger equipment. Ledger advises customers who have purchased from this dealer in the past 90 days not to initialize their equipment. Users who have already initialized can consider transferring funds to new devices and using new recovery phrases.

Victims of this incident should be vigilant because no one-even impersonating technical support staff-needs your mnemonic words. Ledger directs its customers to official support channels to submit work orders. The alert is mainly aimed at buyers and single dealers in Southeast Asia. As of press time, Ledger did not mention any other dealers.

As of October 10, 2026, despite Zhao Changpeng (CZ)'s statement, a specific date for the end of the investigation has not yet been announced. Future communications from Ledger and MistTrack may reveal whether these thefts originated from hardware implants or other mechanisms. Do you think this Ledger hacking incident will affect European customers?