Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 
ETH 
TRX Ledger launches investigation into theft of approximately $86 million
Ledger has officially opened an internal investigation into the theft of approximately $86 million in funds. The funds were allegedly stolen from cryptocurrency cold wallets sold through CryptoBilis. The company's standard security advice is that consumers should only purchase equipment from strictly vetted official sources, and CryptoBilis one of the authorized dealers personally certified by Ledger.
What was the amount stolen from a Ledger dealer?
CryptoBilis is an online store based in Malaysia founded in December 2020 by Arravind Prabu, Vimal Selvamany and Dhivager Rathakrishnan under their company Fetch International. The store had announced in 2021 that it would become an authorized dealer for the Paris-based hardware wallet maker.
On Friday, Ledger said on its official support account that in light of reports that more than $86 million in Bitcoin, Ethereum and Tron were stolen from wallets sold in its stores, the company has asked CryptoBilis to suspend sales and shipments of all Ledger products for investigation.
Anonymous blockchain investigator Specter posted on social media platform X that multiple Ledger users complained about their wallets being emptied on platforms such as X and Reddit. Specter said its investigation into suspected stolen addresses found inflows of funds from hundreds of victim wallets, involving Bitcoin, Ethereum and the Wave Field Network, totaling more than $86 million.
At present, the total amount of losses caused by this hacking attack and whether there is any connection between the individual cases have not yet been confirmed, and the reason for the crime is still unknown. Ledger pointed out that there is currently no evidence that its own systems or wallet software have been compromised.
Ledger recommends that users who purchased equipment from this dealer within the past 90 days not activate the equipment for the time being. Customers who have already activated their wallets are told to transfer funds to another Ledger device that uses the newly generated mnemonic.
What are the main theoretical speculations?
A popular theory about how attackers carry out hacking is that it is a "supply chain attack." In this attack mode, the device is tampered with before reaching the buyer, resulting in the mnemonic used to recover the wallet being known to the attacker before the device is delivered. Once the funds are transferred to the wallet, the attacker can ransack it.
This tactic was documented as early as 2023, when Kaspersky researchers discovered a tampered Trezor Model T hardware wallet. The device's main chip has been replaced and the software has been implanted with malicious code, allowing user-generated mnemonic words to be actually one of 20 phrases known to the attacker. In this case, the attacker waited about a month before emptying his wallet.
此前有报道指出，Ledger 曾于 5 月放弃计划中的 40 亿美元美国首次公开募股（IPO），原因是市场环境不佳。该公司当时表示正在考虑进行私募融资，但随着此次新的安全丑闻爆发，这一前景似乎变得渺茫。
值得注意的是，Ledger 今年 1 月曾披露一起独立事件，其支付处理商 Global-e 发生了客户数据泄露。调查员 ZachXBT 对此评论称，硬件钱包公司不应被视为个人信息的可靠保管方。
