Theft of $92.9 million in wallets from Bitcoin, Ethereum and Wave Chain: Related to ledgers

More than $92.9 million was lost from hundreds of crypto wallets in what investigators called a supply chain attack related to Ledger's hardware wallets

In what was known as a "supply chain attack," more than $92.9 million was diverted from hundreds of crypto wallets. The attack involved Ledger hardware wallets sold through dealers in Southeast Asia. Bitcoin, Ethereum, Wave Field (TRON) and at least three other networks have all been affected, and the whole picture is still gradually becoming clear.

Details of Ledger's $92.9 million wallet capital loss incident

Reports of the capital loss incident began to emerge when users reported that they had suffered a full loss of funds after purchasing Ledger equipment through a dealer called CryptoBilis. CryptoBilis operates in Indonesia , Malaysia and the Philippines. Ledger's official support team confirmed that it was investigating the matter and immediately asked CryptoBilis to suspend sales and shipments of all Ledger equipment.

Ledger said: "We are investigating reports of financial losses from users in Southeast Asia who purchased products from distributor CryptoBilis. As a precautionary measure and while awaiting the results of the investigation, we have asked CryptoBilis to suspend sales and shipments of all Ledger equipment."

Ledger also recommends that recent buyers from CryptoBilis not initialize any uninitialized equipment. For users who have already set up their devices, the company recommends transferring assets to a new Ledger signature device that uses new mnemonics as a precautionary measure.

链上调查机构Bitquery追踪了六个网络上的资金损失情况，并将初步估算值上调。其更新后的统计显示，共有315个钱包中的总计9320万美元被盗，涉及网络包括TRON、比特币、以太坊、Solana、BNB Chain和Polygon。

9320万美元

Bitquery更新的跨6个网络、315个钱包的链上损失统计。

确切的攻击机制尚未得到公开证实。根据现有报道，证据并未表明Ledger的核心基础设施遭到破坏。通过CryptoBilis销售的设备是否为假冒产品、被篡改或通过其他手段受到侵害，目前仍在调查中。

这并非Ledger客户首次面临重大损失。此前，该公司曾调查一起涉嫌从其客户钱包中盗取8600万美元的案件，引发了人们对硬件钱包供应链安全的严重质疑。

比特币、以太坊和波场在此次流失事件中的角色

此次资金流失并非局限于单一区块链。Bitquery的调查将损失映射到六个独立的网络上，其中TRON、比特币和以太坊是与Solana、BNB Chain和Polygon并列的主要受影响链。

The multi-chain nature of the attack is crucial. Once the promised hardware wallet mnemonic is leaked, attackers can access every address derived from the mnemonic, covering all networks. This is why wallets holding completely different assets on different chains can be emptied in a coordinated cleansing operation.

Bitquery also found two weeks of small test transactions before the main fund drain began, a pattern consistent with an attacker's signature of detecting wallets before executing a large withdrawal. This level of pre-attack reconnaissance activity suggests that it was a carefully planned and methodical operation rather than an opportunistic use.

Tether took measures to limit losses on the stablecoin side and froze US$10 million in USDT related to the incident.

US$10 million

The USDT frozen amount reported by Tether during the response.

The $10 million freeze represents part of the recovery effort. Most of the stolen funds scattered across Bitcoin, Ethereum, wavefields and other links remain unrecovered. Unlike USDT, most native assets on the chain cannot be frozen after the fact.

Similar cross-chain strategies have also appeared in other hardware-related vulnerability incidents. The Coinsbuy hack stole $8 million across two blockchains and also demonstrated how multi-chain exposures amplify losses when a single point of failure is exploited.

Key facts to focus on as the Ledger wallet loss story evolves

Headline data of $92.9 million comes from earlier statistics;Bitquery's more detailed online survey raised the figure to $93.2 million, involving 315 wallets and six networks. These two numbers may continue to change as the investigation deepens.

Binance co-founder Zhao Changpeng (CZ) posted a comment on the X platform, directly warning recent Ledger buyers:

"ˇIf you use Ledger hardware wallets, especially those purchased recently, please be careful. Based on current information, this appears to be a localized supply chain attack caused by a single supplier. A small number of people may have purchased counterfeit (or tampered with) Ledger equipment."

CZ characterized the incident as "seemingly limited to a supply chain attack with a single supplier," describing it as only a small number of people purchasing counterfeit or compromised equipment. This view is consistent with Ledger's own statement, but as of press time, neither Ledger nor any independent forensic analysis agency has confirmed the specific attack mechanism.

Readers should pay attention to the following points in subsequent reports: whether forensic analysis confirmed that the hardware was tampered with or other vulnerability vectors existed; whether affected users outside of Indonesia , Malaysia and the Philippines showed up; and whether Ledger or CryptoBilis took further recovery steps in addition to suspending sales.

Tether's $10 million freeze suggests partial recovery is possible, but for most victims of holding non-freezable assets, the recovery window depends on law enforcement being able to prevent funds from being laundered Previously tracked and confiscated them. Previous Ledger Ethereum application incidents were patched before full utilization occurred and no damage was ultimately caused. This time, the damage has been done.

Can the hardware wallet supply chain withstand such rigorous scrutiny? With more than $93 million in funds missing and 315 wallets confirmed to have been lost, this issue will accompany every Ledger sale in the coming months.