On October 9, dozens of cryptocurrency wallets began emptying almost in unison. The first visible wave hit TRON. Ethereum, BNB Chain and Polygon followed, then more than 200 BTC left over a hundred Bitcoin wallets in a single block.
The common link identified so far is not a blockchain or an asset. Ledger says the affected users it is investigating bought hardware wallets from CryptoBilis, an authorised reseller serving Indonesia, Malaysia and the Philippines.
That distinction matters. This is not, on current public evidence, a proven break of Ledger's firmware, its Secure Element or the cryptography securing every Ledger device. It is an incident in which someone appears to have gained the master secrets controlling many wallets sold through one distribution channel.
The loss is still being counted. Bitquery's detailed report initially measured $92.9 million leaving 311 wallets on five chains, using data cut off late on October 9. Its investigation index has since raised the headline count to $93.2 million from 315 wallets on six chains. Those figures should be treated as a moving estimate, not a final victim total. One person can own several wallets, and one wallet address can be active on several compatible networks.
What is already visible on-chain is unusually strong. What caused it is not.
The transactions look like one operator with many keys
On TRON, 25 wallets approved the same address within three seconds. Within six seconds of the first approval, roughly $29 million in USDT had been pulled. On Bitcoin, 111 wallets were swept in the same block. The wider operation crossed networks whose transactions cannot be authorised by one universal token approval.
Bitquery also found two weeks of small rehearsal transactions. Attacker-linked addresses ran repeated test loops on TRON and Ethereum from September 25. One test address later participated in a $36 million drain. Gas was placed where it would be needed before the main operation.
This pattern does not resemble hundreds of people independently making the same mistake at the same moment. It is consistent with software already able to sign for many wallets, most plausibly because one operator possessed their recovery phrases or derived private keys.
That conclusion is narrower than it sounds. A blockchain can show that the right keys signed. It cannot show how the attacker obtained them.
Four routes to the keys, none yet proven
The first possibility is malicious signing. A user can connect to a fake application and approve a transaction that gives an attacker control of a token. This remains a routine cause of losses, especially on smart-contract chains. It does not neatly explain Bitcoin wallets and assets across several networks being drained together.
The second is phishing for recovery phrases. Anyone who obtains the 24 words can reconstruct the wallet without possessing the physical device. A common customer database could help an attacker target buyers with convincing support messages. Public evidence has not yet established a campaign that captured the phrases of this many affected owners.
The third is pre-seeding. A hostile seller could initialise a device, retain the recovery phrase and persuade the buyer to use that phrase. Ledger states that a genuine new device never arrives with a PIN or recovery phrase already provided. Any device that does should be considered compromised.
The fourth, and the most alarming, is a physical supply-chain implant. Security researchers have demonstrated that this is technically possible. Joe Grand and Tibane Labs have documented genuine Nano X devices modified with a hidden board that listens to the display connection as the recovery words appear. The implant does not need to defeat the Secure Element. It watches the words on their way to the screen and can transmit them to an attacker.
These specimens explain a possible method. They do not prove that the CryptoBilis victims received implanted devices. That requires physical forensics on their actual hardware and a documented link between the examined devices and drained wallets.
We are also excluding claims circulating on social media about a sale of CryptoBilis and a time-limited non-disclosure agreement. Signal21 has not found primary documentation sufficient to present those claims as facts.
Why a device can pass Genuine Check and still have a problem
Ledger's Genuine Check performs a cryptographic challenge against the Secure Element inside the device. A valid response confirms that the chip is genuine and holds a factory-issued secret. This is a powerful defence against a fully counterfeit product.
It is not a complete record of everything that happened to the device after it left the factory.
Ledger's own buying guide now states this boundary explicitly: the check cannot detect an unauthorised physical modification, such as a spying implant, when the original Secure Element remains intact. A device can therefore contain a real security chip and pass the check while another component observes what is shown on its screen.
This is not evidence that every affected device contained such a component. It explains why passing an authenticity check cannot, by itself, close the supply-chain hypothesis.
What CryptoBilis buyers should do now
Ledger has asked CryptoBilis to pause sales and shipments while the investigation continues. Its October 9 notice gives two immediate precautions for customers who bought a Ledger device from the reseller in the preceding 90 days:
- If the device has not been set up, do not initialise it.
- If it has been set up, consider moving assets to a new trusted signer with a newly generated recovery phrase.
On-chain researchers found that some victim wallets first received funds just outside that 90-day window. The date a wallet was first funded is not the date its device was purchased, so it cannot prove a wider sales window. Anyone who bought from CryptoBilis earlier and is uncertain should contact Ledger through its official support site and treat the situation conservatively.
Moving funds must be done carefully. Use a device and wallet environment you trust, generate a completely new recovery phrase on that trusted device, verify the destination address on its screen and send a small test transaction first. Do not type the old or new recovery phrase into a website, desktop program, phone app, support chat or direct message. Ledger support will not need those words.
Do not dismantle a device casually. Opening it can damage the hardware and may destroy useful evidence. Owners who believe they are affected should first preserve purchase records, packaging, serial information and transaction IDs, then coordinate with official support and the relevant authorities.
The uncomfortable lesson is about trust boundaries
A hardware wallet removes private keys from an internet-connected computer. It does not remove every form of trust from the journey between a factory and a user's hands.
The Secure Element can be genuine. The firmware can be uncompromised. The user can correctly write down the words that appear on the device. A hostile component placed elsewhere in the physical path could still observe those words. That is why the source of the device, the integrity of its distribution and the setup ritual are all part of the security model.
For now, the responsible conclusion is limited. The October 9 transfers show a planned, multi-chain operation by someone who appears to have controlled many wallet keys. Ledger has linked its investigation to CryptoBilis buyers and issued precautions. A supply-chain attack is plausible and existing implant research shows how one could work, but the specific mechanism behind these losses has not been publicly established.
That last sentence may change quickly. Until device forensics and Ledger's incident report arrive, certainty would be less informative than a clear map of what the evidence can, and cannot, prove.
Security note: This incident is still developing. Follow Ledger's official support channels for updated instructions. Never share a recovery phrase or enter it into any website, app or support conversation.