Big security story from Friday, Oct 9. Users who bought Ledger hardware wallets from CryptoBilis, an authorised reseller in South East Asia, got their wallets drained.
How big?
Counts kept climbing all day. On-chain sleuths first said $72M+, then $86M+. MistTrack said losses were "approaching $90 million". Bitquery's latest count is $92.9M from 311 wallets across TRON, Bitcoin, Ethereum, $BNB Chain and Polygon. TRON was the biggest at about $70.5M, then Bitcoin at about $16.8M (around 203.8 $BTC ).
Bitquery says 25 TRON wallets signed the same approval within 3 seconds, and 111 Bitcoin wallets were swept in a single block. Test transfers ran from Sept 26 to Oct 7. That looks like one actor holding the keys, not random phishing.
Ledger's side: it paused sales through CryptoBilis and said the drained funds look limited to devices sold by that reseller. It also said its own infrastructure, systems and services were not compromised. The cause is still not confirmed.
Tether moved fast. It blacklisted addresses within about ten minutes of the first public post, and around $10M USDT is now frozen. But the attacker adapted. Roughly $14.9M of $USDT was swapped into USDD, which Tether can't freeze, about $20M was bridged and turned into ETH, and around $3.1M of $ETH went to Tornado Cash. Remember, frozen is not recovered. Nothing has been returned to victims yet.
Why it matters: this isn't a market-wide hack, but it hits trust in "safe" cold storage and shows how far freeze powers really go. Those 203.8 BTC sitting in attacker wallets are also a small overhang if they ever move.
If you bought a Ledger from a reseller, Ledger says move funds to a new device bought direct, with a fresh seed phrase. Never type your seed anywhere.
BITCOIN CMP: 82,767 (-0.3% 24h)
24h range: 82,241 – 83,269 | Week low: 80,345
⏱ Short term
Hold 82.2K = range stays bullish
Reclaim 83.5K = 84.5K next
Lose 82.2K = back to 81.7K, then 80.3K