Exsiway (@exsiway) believes he has figured out exactly how $91 million was drained from Ledger hardware wallets overnight. After reviewing company registries, on-chain data, and the wallet’s
Exsiway (@exsiway) believes he has figured out exactly how $91 million was drained from Ledger hardware wallets overnight. After reviewing company registries, on-chain data, and the wallet’s teardown, the findings point to a very deliberate move. Much more than a standard hack.
Ledger produces hardware wallets. These are physical devices that store private keys offline, keeping funds away from internet-based threats. They are widely regarded as one of the safest ways to hold crypto.
On October 9, many Ledger users in Southeast Asia found their wallets completely emptied, with total losses reaching approximately $91 million.
CryptoBilis is a hardware wallet shop based in Malaysia. Ledger listed it as an official authorized reseller since at least 2022, covering Malaysia, Indonesia, and the Philippines. It operated normally for years, serving real customers with genuine devices.
This past spring, the founders sold the business. The sale included a non-disclosure agreement preventing the sellers from revealing the transaction until October 19. By August, company registry records showed 100% ownership transferred to a single individual from Heilongjiang, China.
The website stayed live, and the shop kept running. The “authorized by Ledger” badge remained on the site. However, Ledger received no public notification of the ownership change.
On October 8, Mark Karpelès (@MagicalTux) physically opened a Ledger device purchased from Malaysia and found something unexpected. Hidden beneath the screen sat a small additional circuit board fitted with an LTE modem and an eSIM.
The board monitored the display passively. Even investors who never disclosed their seed phrases were affected. When a user set up the device and the 24-word seed phrase appeared on screen, the board captured it and transmitted it out over mobile data.
Ledger’s own authenticity verification passed the device because the original Ledger chip inside was genuine. Experts often advise investors to use hardware wallets because of their safety. The tampering existed in the extra hardware added on top. Exsiway noted that the post reached 120,000 views.
22 hours after Karpelès’ post went public, the attack was executed. 203 BTC hit two addresses in a single block. Approximately $58 million in USDT moved on Tron within the same hour. Total losses across all affected wallets reached roughly $91 million.
Seven hours after the drain, Ledger publicly stated it was investigating and asked CryptoBilis to pause all sales and shipments. CryptoBilis still appeared on Ledger’s website as an authorized reseller at that point.
Exsiway raises a critical point about what “authorized reseller” actually means. Ledger granted that status in 2022 based on trust in the people running the shop. It says nothing about whoever owns the shop today. The NDA attached to the sale prevented the founders from publicly disclosing the change of ownership, right through the period the attack unfolded.
He outlines a possible sequence of events. A shop starts by earning authorized status. Then it remains genuine for years. The founders sell it quietly under a confidentiality agreement. The new owner inherits the badge and the reputation and ships compromised devices. Once enough customers complete setup, the funds get drained all at once.
Exsiway also notes that Ledger’s genuine check cannot catch this attack. The actual Ledger chip is real. Only the added hardware is malicious, and Ledger’s verification does not scan for physical additions inside the casing.
This follows the Bitget incident in September, where over $350 million was stolen. He closes with a question about accountability. He asked whether responsibility falls on the new owner, the original sellers, or Ledger itself for failing to monitor who holds authorized reseller status.
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
The post Update for XRP Holders: How $91 Million Was Drained From Ledger Wallets appeared first on Times Tabloid.
