Ledger hack scare nears $90 million as Tether moves to freeze stolen USDT

What happened

Suspected thefts from Ledger wallets are approaching $90 million, according to blockchain investigators. Ledger said in an Oct. 9 statement that it is investigating reports that customers lost funds after buying devices from CryptoBilis, an authorized reseller operating in Southeast Asia.

Ledger asked the distributor to pause sales and shipments of its hardware wallets while the investigation continues. It advised customers who purchased devices from CryptoBilis in the past 90 days not to initialize them if setup was not complete, and urged those who had already configured their wallets to consider moving funds to a new Ledger device with a fresh recovery phrase.

On-chain investigator Specter said transaction analysis identified inflows from hundreds of suspected victim wallets into addresses across Bitcoin, Ethereum, and Tron. The researcher first estimated the suspected thefts exceeded $86 million, while blockchain security firm MistTrack later placed the reported losses closer to $90 million.

Tether has frozen approximately $10 million in USDT linked to the activity, Finbold reported. Researchers observed coordinated transfers across TRON, Bitcoin, Ethereum, BNB Chain, and Polygon, with most of the value moved in USDT on TRON.

Why it matters

Hardware wallets are bought to hold keys offline, so losses tied to devices sold through an authorized reseller touch the distribution chain that buyers rely on. Ledger has said its infrastructure, systems, and services were not compromised and that the investigation appears to concern the reseller and the affected market. The affected customers appear concentrated in Indonesia, Malaysia, and the Philippines.

Binance founder Changpeng Zhao warned users to exercise caution, particularly if they had recently purchased a Ledger device. He said the case looked localized to a supply chain attack with one vendor and called for industry help to trace and recover the funds.

Former Mt. Gox CEO Mark Karpelès is investigating whether malicious hardware components were inserted into devices distributed to customers, and asked CryptoBilis to open unsold Ledger wallets for inspection. Ledger's documentation acknowledges that its Genuine Check system verifies a device's Secure Element but cannot necessarily identify physical modifications elsewhere if the original security chip remains intact.

What the data shows

Loss estimates vary. Specter's early figure was above $86 million and MistTrack's was closer to $90 million, while some independent estimates put the total at $92.9 million across hundreds of addresses.

Lookonchain tracked individual cases. One Bitcoin address received 80 BTC roughly 10 days before the funds were swept out in a single transaction on the morning of October 9, the coins had been acquired four months earlier at around $65,000 each. A TRON wallet identified as TY24Ya held 7 million USDT and lost the full balance, and an Ethereum address lost 59 ETH.

The losses land in a heavy year for crypto theft. Finbold Research reported that cryptocurrency hacks accounted for more than $1.17 billion in losses in the third quarter of 2026, bringing the year's total to approximately $2.1 billion. The report also identified a separate $100 million Coldcard incident involving a hardware wallet.

What is still unclear

• Ledger has said it has not disclosed how many devices may have been compromised or established whether the incident resulted from counterfeit hardware, physical tampering, or another attack method.
• The cause of the losses has not been conclusively established, though industry observers have raised the possibility of a supply-chain issue involving devices distributed through the reseller.
• No confirmed evidence shows that malicious hardware implants caused the reported thefts.

Questions readers ask