More than $92.9 million drained from hundreds of crypto wallets in what investigators are calling a supply-chain attack tied to Ledger hardware wallets sold through a Southeast Asian reseller
More than $92.9 million drained from hundreds of crypto wallets in what investigators are calling a supply-chain attack tied to Ledger hardware wallets sold through a Southeast Asian reseller. Bitcoin, Ethereum, TRON and at least three other networks were hit, and the full picture is still coming into focus.
Reports of the drain emerged when users who purchased Ledger devices through a reseller named CryptoBilis, operating in Indonesia, Malaysia and the Philippines, began reporting total losses of funds. Ledger Support confirmed it was investigating and immediately asked CryptoBilis to pause all sales and shipments of Ledger devices. For related coverage, see BTCPay Backers Offer Bitcoin Bounty After Wallet Exploit.
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.… For related coverage, see Liquid Hackers Return $270M in Bitcoin After $320M Theft.
— Ledger Support (@Ledger_Support) October 9, 2026
Source: @Ledger_Support on X
Ledger also advised recent CryptoBilis buyers not to initialize any uninitialized devices. For those who had already set up their hardware, the company suggested moving assets to a new Ledger signer with a fresh seed phrase as a precaution.
On-chain investigators at Bitquery traced the losses across six networks, revising an initial estimate upward. Their updated count puts the total at $93.2 million taken from 315 wallets spanning TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon.
$93.2 million Bitquery’s updated on-chain loss count across 315 wallets and six networks.The exact attack mechanism has not been publicly confirmed. According to available reporting, the evidence does not establish that Ledger’s core infrastructure was compromised. Whether the devices sold through CryptoBilis were counterfeit, tampered with, or compromised through another means remains under investigation.
This is not the first time Ledger customers have faced significant losses. The company had previously been investigating an alleged $86 million drain from customer wallets, raising serious questions about the hardware wallet supply chain.
The drain was not confined to a single blockchain. Bitquery’s investigation mapped the losses across six separate networks, with TRON, Bitcoin and Ethereum among the chains most prominently named alongside Solana, BNB Chain and Polygon.
The multi-chain nature of the attack matters. A compromised hardware wallet seed phrase gives an attacker access to every address derived from that seed, across every network. That is why wallets holding entirely different assets on different chains can be emptied in a coordinated sweep.
Bitquery also found two weeks of small test transactions before the main drain began, a pattern consistent with attackers probing wallets before executing large-scale withdrawals. This level of pre-attack reconnaissance suggests a deliberate and methodical operation, not opportunistic exploitation.
Tether moved to limit the damage on the stablecoin side, freezing $10.0 million in USDT linked to the incident.
$10.0 million USDT reported frozen by Tether during the response.The $10.0 million freeze represents a partial recovery effort. The majority of drained funds, spread across Bitcoin, Ethereum, TRON and other chains, remain unrecovered. Unlike USDT, native assets on most chains cannot be frozen after the fact.
Similar cross-chain tactics have appeared in other hardware-adjacent exploits. The Coinsbuy hack, which drained $8 million across two blockchains, also demonstrated how multi-chain exposure amplifies losses when a single point of failure is exploited.
The headline figure of $92.9 million comes from an earlier count; Bitquery’s more detailed on-chain investigation raised that figure to $93.2 million across 315 wallets and six networks. Both numbers will likely continue to shift as the investigation expands.
Binance co-founder Changpeng Zhao weighed in on X, warning recent Ledger buyers directly.
⚠️ Beware if you use a Ledger hardware wallet, especially if you bought one recently.
Based on information so far, it seems to be localized to a supply chain attack with one vendor. A small number of people probably bought fake (or tampered) Ledgers.
— CZ 🔶 BNB (@cz_binance) October 9, 2026
Source: @cz_binance on X
CZ characterized the incident as appearing “localized to a supply chain attack with one vendor,” describing it as a small number of people who likely bought fake or tampered devices. That framing aligns with Ledger’s own statement, though neither Ledger nor any independent forensics firm has confirmed the specific mechanism as of this writing.
What readers should track in follow-up coverage: whether a forensic analysis confirms tampered hardware or a different compromise vector; whether affected users outside Indonesia, Malaysia and the Philippines emerge; and whether Ledger or CryptoBilis take any further recovery steps beyond the sales pause.
The $10.0 million Tether freeze shows that some recovery is possible, but for most victims holding non-freezable assets, the window for recovery depends on whether law enforcement can trace and seize funds before they are laundered. The previous Ledger Ethereum app incident, which was patched before a full exploit, ended with no losses. This time, the damage is already done.
Could the supply chain around hardware wallets withstand this level of scrutiny? With over $93 million gone and 315 wallets confirmed drained, that question will now follow every Ledger sale for months.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The article Ledger-Related $92.9M Wallet Drain Across Bitcoin, Ethereum and TRON first featured on theccpress.com.
