Ledger Wallet Losses Near $90 Million; Tether Freezes USDT

Suspected cryptocurrency losses linked to Ledger hardware wallets sold by Southeast Asian reseller CryptoBilis are nearing $90 million. Tether has frozen USDT connected to the incident while Ledger investigates whether customers received counterfeit, tampered or otherwise compromised devices.

Ledger announced Oct. 9 that it was examining reports of customers losing funds after buying wallets from CryptoBilis. The reseller appears in Ledger’s authorized-reseller directory for Malaysia, Indonesia and the Philippines. Ledger asked CryptoBilis to pause sales and shipments during the investigation.

Ledger advised customers who bought devices from CryptoBilis within the past 90 days not to initialize them if setup was incomplete. Customers who had already configured their wallets were urged to consider moving their assets to a new Ledger device created with a fresh recovery phrase.

Ledger has not disclosed how many devices may be affected or identified how the funds were accessed. Investigators have not determined whether the losses resulted from counterfeit products, physical tampering, a supply-chain attack or another form of compromise.

Blockchain investigator Specter reported that transaction analysis found funds moving from hundreds of suspected victim wallets to addresses on the Bitcoin, Ethereum and Tron networks. Specter initially estimated the losses at more than $86 million. Blockchain security firm MistTrack later put the reported total near $90 million.

The estimates have not been independently verified. Investigators have not confirmed that every wallet included in the calculations was affected by the same operation.

MistTrack reported that Tether froze USDT linked to the suspected thefts after several affected users requested help. Tether’s stablecoin has administrative controls that allow the company to restrict transfers from designated addresses. Frozen USDT cannot move through ordinary blockchain transactions, but the restriction does not automatically return the tokens to their owners.

Tether has not disclosed the amount of USDT frozen. The company cannot directly freeze native Bitcoin or Ethereum. Recovery of those assets may depend on cryptocurrency exchanges, custodians and law enforcement. The funds may become harder to trace if they move through more wallets or are exchanged for other assets.

Binance founder Changpeng Zhao described the incident on X as a possible supply-chain attack involving one vendor. “Based on information so far, it seems to be localized to a supply chain attack with one vendor,” he wrote. Zhao also called for cryptocurrency companies to help trace and recover the funds.

Former Mt. Gox chief executive Mark Karpelès is examining whether unauthorized hardware components were added to devices distributed by CryptoBilis. He asked the reseller to open unsold Ledger wallets so their circuit boards could be inspected for possible spying implants or other modifications.

Ledger’s security documentation says its Genuine Check system verifies a device’s Secure Element, the chip that protects private keys. The check may not detect changes elsewhere in the hardware if that chip remains intact. There is no confirmed evidence that malicious hardware implants caused the reported thefts.