Estimated losses from the Ledger wallet breach have climbed further. Recent on-chain data from two blockchain analytics firms indicates the total stolen crypto has now reached $93.2 million to $94.5 million. This updates an initial estimate of $86 million to $92 million that circulated days prior.
Bitquery recorded $93.2 million in losses drained from 315 wallets across six different blockchains. Meanwhile, YFarmX tallied $94.5 million from 521 addresses across seven networks. Both firms identified a similar pattern: hackers heavily targeted USDT and TRON tokens. Ledger has yet to announce an official loss figure. However, the root cause of the incident does not lie in a software vulnerability, but rather in the physical supply chain.
Hardware Implants Behind Official Reseller Listing
Fierce criticism emerged as CryptoBilis was listed as an official reseller on Ledger’s website. That official partner badge led buyers to believe the purchased units carried direct security guarantees from the manufacturer. Victims who lost funds are now venting fury across the crypto community with a firm message: this is not a CryptoBilis incident, but a Ledger incident.
Consumer concerns proved justified when Ledger confirmed the discovery of unauthorized hardware implants on at least one affected unit. Even so, the French wallet manufacturer has yet to clarify whether hundreds of other breached addresses were compromised through similar chip tampering.
A Different Pattern From Fake App Breaches
The latest attack differs markedly from the April 2026 incident, when Ledger users lost $9.5 million to a phishing campaign involving a counterfeit Ledger Live app on Apple’s App Store. At the time, victims were duped via social engineering into entering recovery phrases into the rogue application.
The CryptoBilis case presents a far more dangerous scenario. Attackers did not coax victims into handing over information, but instead held the secret keys from the start, directly draining hundreds of wallets as soon as funds arrived. The hackers retained control without having to wait for wallet owners to make a careless mistake.
Where the Remaining Funds Are Moving
Roughly $81 million in stolen funds remains traceable on public blockchains as of October 11. The attackers have begun fragmenting fund flows by moving portions of the assets through privacy protocols Tornado Cash and Zcash. On the other hand, Tether froze $10 million in USDT tied to the attacker’s addresses after receiving confirmation from Bitquery.
Ledger did not immediately respond to requests for comment regarding total losses or compensation plans for victims. For buyers who already placed orders through CryptoBilis, Ledger advised that sealed units should not be activated at all. For owners who have already set up their devices, all assets should be moved immediately to a new wallet using a freshly generated recovery phrase.
Reported by CoinDesk.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
