Ledger asks reseller to pause sales after $93m wallet theft

A thief holding the keys to hundreds of crypto wallets emptied them on the morning of 9 October 2026. From 05:07 UTC, wallets on Tron, Bitcoin, Ethereum, BNB Chain and Polygon were swept into a handful of collecting addresses, after smaller Bitcoin sweeps that began on 7 October. By our count of the chains themselves, $93.4m left 468 addresses.

Ledger responded at 13:32 UTC. It said it was investigating “reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis”, and that it had asked the reseller to pause all sales and shipments of Ledger devices. The company’s own spelling is CryptoBilis, with one l, and Ledger lists it as an authorised reseller.

Update, 9 October, 17:10 UTC: ether out of Tornado Cash is being turned into Zcash

Between 15:17 and 15:57 UTC the thief paid 1,253.9 ETH ($3.11m) into Tornado Cash in three waves, from three of its eleven ether wallets. The third wave is traced all the way through: its withdrawals are tied to the thief by the gas that paid for them, and 179.9 ETH of them had been swapped into 365.95 ZEC at seven shielded Zcash addresses by 17:07 UTC. The other eleven ether wallets were unmoved at 17:07. The 213.37 BTC ($17.67m) still sits in the three Bitcoin collectors. Tether has kept 10,000,001 USDT frozen in 20 of the thief’s wallets, after releasing four busy service addresses at 15:30 UTC that held other customers’ money as well. We are watching further addresses that match the thief’s habits on chain, and will name each one once the link is proven.

What Ledger told its customers

Ledger’s statement on the incident, posted by its support account at 13:32 UTC on 9 October, gives buyers two instructions. Anyone who bought from the reseller in the last 90 days and has not set the device up should not start. Anyone who has should “consider moving assets to a new Ledger signer (with new seed)”.

The 90 days run back to 11 July 2026. The statement covers the reseller and that window, and it is the only one we found from Ledger by 15:45 UTC.

The earliest public report we found is a reply to Ledger’s account at 07:47 UTC from a user who wrote that their wallet “just got hacked without me signing anything” and that the recovery phrase “was hand written in the card and being kept in a safe since”. The first public question linking a victim to CryptoBilis came at 11:19 UTC.

The on-chain analysts published first. tanuki42 listed eight collecting addresses at 12:00 UTC with a loss of “>$72M+”, and the Security Alliance’s emergency team, SEAL 911, asked victims to contact it at 12:29 UTC. Specter added two Bitcoin addresses and an estimate of “$86M+” at 12:24 UTC, and Hacken counted “~$81M” across eight addresses at 13:45 UTC.

CryptoBilis is on Ledger’s own reseller list

Ledger’s official reseller finder lists CryptoBilis for Malaysia, Indonesia and the Philippines. On the Malaysia entry, as listed on 9 October, it sits second, under the Shopee Mall store that carries Ledger’s name.

CryptoBilis describes itself on its Ledger page as “the authorized reseller of Ledger Products in Malaysia”. Its home page says orders ship from Kuala Lumpur, and a sister site serves the Philippines. It also sells Trezor, SafePal, Tangem, OneKey and other hardware wallets.

That listing is the route Ledger recommends. Its buying guide tells customers that “Ledger maintains a dynamic, official registry of Authorised Resellers”, and its security team’s threat model says buying “directly from Ledger or Authorised Resellers is safer”. The same page adds that Ledger’s checks cannot verify “the device’s physical supply chain history”.

The thief took $93.4m from 468 addresses

Reading every transfer into the ten published collectors, and three more Tron collectors we found, the theft comes to about $93.4m taken from 468 addresses on seven blockchains. Three quarters of it was Tether’s USDT on Tron.

Bitcoin and ether are valued at Chainlink’s prices at 15:21 and 15:09 UTC on 9 October, $82,835 and $2,484; TRX, BNB and PEPE at CoinGecko’s prices at 14:38 and 14:40 UTC; USDT and USDC at $1. The EVM rows count 58 distinct addresses, because some victims held the same address on several chains, and one person can hold several addresses.

The main run was on 9 October: every Tron and EVM sweep, and 139 of the 276 Bitcoin sweeps, carrying 205.95 BTC ($17.06m). The other 137 Bitcoin sweeps, small and mostly from wallets dormant for years, began at 14:41:59 UTC on 7 October and carried 7.42 BTC ($614,639).

The losses are concentrated. The largest single Tron account lost 7,001,000 USDT and the largest Bitcoin wallet lost exactly 80 BTC ($6.63m); the 20 largest Bitcoin wallets account for 88% of the bitcoin taken. The median Tron loss was 150,000 USDT. Several groups of Tron accounts were created within minutes of each other, 20 of them in 42 minutes on 20 June 2026.

Every drain needed the victim’s own key

Every one of the 468 addresses was emptied by a transaction signed with its owner’s private key, or by a key or wallet that the owner’s key had authorised earlier. That control comes from the recovery phrase, which derives the keys for every chain a wallet holds.

The chains show three methods on Tron. At 04:59:57 UTC, 30 accounts had their owner permissions rewritten to add the thief’s key TEqZsE39… at a weight that lets it sign alone; they were drained between 10:26 and 11:16, more than five hours later. At 05:07:48, 27 accounts that had just signed an unlimited approval were pulled by the operator wallet TAzdU79… in six seconds, moving 29.17m USDT. Another 76 accounts sent plain transfers signed with their own keys.

On Ethereum, BNB Chain and Polygon, 144 of 156 inflows are ordinary transfers signed by the victims at a flat gas price on each chain, almost all between 05:07 and 06:07 UTC and the last at 08:11. The other 12 are approvals followed by pulls from the operator wallet 0x381825de…, which had sent the victims gas seconds earlier.

The Bitcoin sweeps follow one script. All 276 share one build: each spends every coin of a single address into one collector with no change, version 1, no locktime, no fee bumping, at a fixed fee rate per batch. The main batch, 112 sweeps worth 203.26 BTC ($16.84m), landed in block 970,590 at 05:54:20 UTC, 47 minutes after the first Tron and EVM sweeps.

The thief’s wallets were ready two weeks early

The thief’s wallets were funded and tested from 24 September, a fortnight before the main run. The EVM operator 0x381825de… was funded on 24 and 25 September, then rehearsed the approve, pull and sweep routine on more than a dozen throwaway wallets across five chains from 26 September to 7 October.

On Tron, the operator TAzdU79… was created on 25 September. On 2 October at 09:20:54 UTC a 3 USDT test payment from it, passed through a second new wallet, created the first Tron collector.

The chains tie the Tron collectors to the Ethereum ones. At 06:32:06 UTC, 500,000 USDT left Tron collector TK6DWN… for a NEAR Intents deposit address, and 89 seconds later NEAR Intents’ Ethereum payout wallet sent 197.99 ETH ($491,717) to Ethereum collector 0x83aeac16…. Two THORChain swaps from Tron wallets that the collectors fed name the thief’s Ethereum swap wallets in their memos.

Spy implants have been found inside Ledger devices

Ledger is still investigating the cause. One documented way for a genuine-looking Ledger to leak its phrase is a hardware implant that reads the recovery phrase off the device’s own screen and sends it out over a mobile network.

The hardware researcher Joe Grand presented a teardown of one, found in a Ledger Nano X, at hardwear.io USA in May 2026. His slides describe a board that “monitors SPI traffic between Nano X Secure Element and OLED”, matches the letter shapes of the recovery words, stores them and transmits them “via cellular module”. The battery was shrunk to make room.

Mark Karpelès has been publishing photographs of the same kind of implant since 16 September, from Nano X units he bought himself from marketplace sellers. He says one was on sale at close to half price on a well-known platform “via a Chinese seller (product shipped from Malaysia)”, and on 27 September he described buying another discounted Ledger on Amazon. At 13:53 UTC on 9 October he posted the photographs below with the words “This looks like this could be exactly what I’m investigating”, and at 14:03 UTC he asked CryptoBilis to open devices from its stock to check.

Ledger’s own documents explain why such a device passes its checks. Its Genuine Check proves the secure chip was made by Ledger. Its support page and its security team’s threat model both say the check “cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact”. Ledger’s support page publishes reference photographs of each model’s board so owners can compare.

Older wallets were drained too

The drained wallets range from a few days old to more than five years old. More than 90% of the bitcoin sat in addresses first funded within the 90 days Ledger named, and 28 of the 33 Ethereum victim wallets were first funded in that window.

On Tron, 69 of the 129 accounts drained into the four published collectors were created within the 90 days, holding 47% of the USDT taken from them; the oldest was created on 6 January 2025. On Bitcoin, 134 of the 276 addresses were more than a year old, the oldest first funded on 15 June 2021.

Most of the Tron money became ether on Ethereum

The Tron collectors started moving the stolen USDT at 05:26 UTC, splitting it into exact 500,000 USDT parcels and sending it through bridges and swap services to Ethereum, where most of it sits as ether.

The ether gathered in the three Ethereum collectors and eight new wallets. Most of the stablecoins taken on Ethereum, BNB Chain and Polygon passed through Relay, LI.FI and 1inch and came back as ether within the hour. On Tron and Bitcoin the trail shows no mixer; on Ethereum, Tornado Cash (below). Our explainer on NEAR Intents describes how its cross-chain swaps settle.

Tether froze $10m, and $14.6m sits in USDD

Tether blacklisted 37 addresses tied to the theft on 9 October: 35 between 12:09:39 and 12:09:45 UTC, one at 12:14:00 and one at 14:10:51. At 15:30 UTC it released four of them, busy service addresses that had taken some of the stolen money along with other customers’ funds. That leaves 10,000,001.11 USDT frozen in 20 of the thief’s own wallets, parcels of about 500,000 that it had split off between 10:01 and 11:12 UTC. One of them tried to send its 500,000 at 12:31:09 UTC and the transfer failed.

From 10:49 UTC the thief had been converting USDT into USDD, Tron’s own dollar stablecoin, at one for one through its stability module. By 14:28 UTC 14,746,211 USDT had gone that way, and 14,646,194 USDD ($14.63m at $0.9992) sat in six Tron addresses at 16:00 UTC. As Hacken put it at 13:45, “Tether’s USDT freeze controls do not apply to USDD.” One of the six was swapping USDD back to USDT in 100,000 lots and bridging it to Ethereum through Relay.

Tornado Cash deposits began at 15:17 UTC

At 15:04:35 UTC, ten hours after the main run began, one of the thief’s ether wallets sent 393.27 ETH ($976,705) to a new address, which split it into 97, 100, 100 and 92 ETH across four more. From 15:17:23 UTC those four deposited 389.2 ETH ($966,596) into Tornado Cash’s 100, 10, 1 and 0.1 ETH pools in 31 notes.

A second ether wallet followed at 15:31:11 UTC with 438.55 ETH ($1.09m) and a third at 15:45:59 UTC with 434.53 ETH ($1.08m), each split the same way. By 15:57 UTC the three waves had put 1,253.9 ETH ($3.11m) into the pools in 74 notes.

Every depositing wallet traces to the ether wallets by plain transfers. Five of the eight were paid their gas by 0x00Bb1C23…, the wallet that paid gas that morning for two of the thief’s bridging wallets, 0x6A33D3E2… and 0xed43bb54…. The second splitter sent its leftover to the wallet that paid the first splitter’s gas, which joins the two waves.

The third wave’s withdrawals are tied to the thief by the gas that paid for them. From 15:58:59 UTC, 18 withdrawals totalling 430.3 ETH ($1.07m) left the pools for 0x3dB57Eaf… and 0xacf7c9a1…. The wallets that sent them had been given their gas minutes earlier through Maya Protocol by 0x6bb8C977… on Arbitrum. Relay’s records show that wallet was funded at 07:59 UTC by 0x1A5F2F0A…, which had paid gas at 05:46 UTC for 0xeD57b891…, one of the thief’s bridging wallets. The same Arbitrum wallet also bought TRX for 22 fresh Tron wallets that each paid 50 TRX to one of the thief’s 500,000 USDT parcel wallets that morning.

From Tornado Cash into Zcash

The ether that came out of the third wave is being swapped into Zcash and paid to shielded addresses, where the trail ends. Between 16:00 and 17:07 UTC the two withdrawal wallets sent 179.9 ETH ($447,702) in seven lots to fresh deposit addresses, and within minutes of each a Zcash wallet shielded a matching amount: 365.95 ZEC ($446,055 at the swap rates) in all, to seven shielded addresses.

The first and largest went at 16:00:23 UTC: 49.9 ETH ($124,131) left 0x3dB57Eaf…, and at 16:02:32 Zcash transaction 8e40095e… (block 3,511,931) shielded 101.61891438 ZEC to u1dc0wghc4hxpue9zwglzy4v0hd7grcaw5zkkqlgdc089ka78fx2vacj7trqr8nx6778n607k0k8l7dc5cu3n56yrkwcewq9r4zum6tvxg. A further 25.0 ETH followed at 16:04:11 and became 50.90925709 ZEC at u19wels7… (transaction 062bc752…, 16:06:34). Once inside Zcash’s shielded pool the coins carry no visible sender, amount or destination, so the seven addresses are where the public trail stops.

The four wallets that took the first two waves’ withdrawals have made the same swaps, 569.7 ETH ($1.42m) into Zcash by 17:07 UTC, and we are checking that link before naming them.

The thief’s eleven ether wallets held 16,435.88 ETH ($40.82m) at 16:00 UTC, and still did at 16:14 UTC.

Where the money sits at 16:00 UTC

The largest share of the stolen money is ether on Ethereum that no issuer can freeze, followed by the bitcoin in the three addresses that collected it and the USDD on Tron.

Each row is a balance or a transfer read from the chains. About 6,920,000 USDT more went to busy service addresses on Tron, where it is mixed with other customers’ funds. The Bitcoin collectors were still taking in sweeps at 15:00 UTC.

The thief’s main addresses

These are the collectors and ether wallets proven on chain, for anyone checking their own exposure or following the money.

What Ledger buyers in the region can do now

Ledger’s advice is to stop and move: anyone who bought from CryptoBilis in the last 90 days and has not set the device up should not start, and anyone who has should consider moving their assets to a new Ledger device with a new recovery phrase.

Ledger’s buying guide says a genuine Ledger never arrives with a recovery phrase or PIN already set. Its support page carries reference photographs of each model’s board for comparison. Victims can contact SEAL 911, which asked anyone drained to these addresses to get in touch.