Ledger users reportedly drained of over $86 million across several blockchains

What happened

On Oct. 9, on-chain investigator Specter said a trace of theft addresses showed more than $86 million in losses from reported drains of Ledger user wallets. Specter said those addresses received funds from hundreds of victim wallets on Ethereum, TRON and Bitcoin. The post put the total at "$86M+".

Specter listed 10 addresses, which held just over $25 million at the last check. An earlier post from tanuki42 put losses above $72 million and listed eight addresses, all of which also appear in Specter's list. The Security Alliance quote-posted that list at 12:29 UTC and tanuki42 asked affected users to contact SEAL 911.

Coinpedia reported that Specter estimated $86.96 million across 98 addresses after reviewing reports from users who said they owned Ledger devices. Ledger said it is investigating losses reported by customers in Southeast Asia who bought hardware wallets from the reseller CryptoBilis, and asked that reseller to halt sales and shipments of its devices as a precaution.

Why it matters

Ledger told customers who bought devices from the reseller in the past 90 days not to initiate setup if they had not already done so. It advised customers whose devices were already set up to consider moving funds to a new Ledger signer with a fresh recovery seed.

The reports do not say how the funds were taken, and they leave open whether Ledger hardware, Ledger software, phishing, stolen recovery credentials or a reseller issue was involved. A device-wide exploit has not been confirmed, and the 98 addresses are not 98 confirmed victims.

A recovery phrase can restore access to funds on another compatible wallet. If an attacker obtains the full 24-word phrase, that person may be able to recreate the wallet's keys and move assets without touching the original device. An additional passphrase adds another layer of protection.

What the data shows

Specter's figure was more than $86 million, and a later estimate put the total at $86.96 million across 98 wallet addresses. tanuki42's earlier estimate exceeded $72 million. The traced addresses held only over $25 million at the last check, which suggests most of the funds have moved.

tanuki42 listed eight addresses, and all of them also appear in Specter's list of 10. Specter's list added two more Bitcoin addresses.

What is still unclear

• No post says how the funds were taken or whether Ledger hardware, Ledger software, phishing or another method was involved.
• It is not established whether the wallets were compromised through stolen recovery credentials, a reseller-related issue or another attack method.
• The 98 addresses do not necessarily represent 98 confirmed victims, and the total losses and cause have not been independently confirmed.

Questions readers ask