Loading story…
Ledger is investigating cryptocurrency thefts affecting Southeast Asian customers who bought hardware wallets from reseller CryptoBilis, with Bitquery estimating losses at approximately $93 million. Ledger said it believed affected devices were limited to those sold through CryptoBilis and reported no indication that its own security infrastructure, systems, or services had been compromised. The theft mechanism remains unconfirmed. Ledger asked CryptoBilis to suspend sales and shipments, advised buyers from the preceding 90 days not to initialize unused devices, and recommended that users of already initialized devices consider transferring assets to a new Ledger device with a new seed.
Tether froze theft-linked USDT, with Bitquery reporting approximately $10 million frozen across 20 wallets, but other funds moved beyond Tether’s freeze controls. Bitquery estimated that 14.9 million USDT had been converted into USDD; TRON records showed one linked address converting 2 million USDT before the incident’s first blacklist actions. On October 10, a wallet MistTrack linked to the thefts routed 464 ETH, worth approximately $1.16 million, into Tornado Cash through 23 deposits, further complicating tracing and recovery. Frozen assets do not automatically reimburse victims, and the amount ultimately recoverable remains unknown.
Track how attackers are adapting to this technology.
23 events from the most recent confirmed update back to the earliest known activity.
On October 13, Ledger published Donjon findings that implants in CryptoBilis-sold wallets capture the 24-word recovery phrase displayed during setup and transmit it over LTE using a provisioned eSIM. The implants leave the Secure Element and Ledger operating system unchanged, so passing Ledger's Genuine Check does not rule out physical tampering.
On October 12, Mark Karpelès identified an alleged early spy implant with numerous wires and a handmade antenna in hardware-wallet photographs posted by X user Us_Chan007. He advised the user to treat the recovery phrase as compromised and move assets; the report did not establish a connection to the confirmed CryptoBilis thefts.
YFarmX reported an estimated $103.4 million in losses across 530 addresses using its own transaction trace, including drains after October 9. Its scope differs from Bitquery's updated $93.2 million estimate across 315 victim wallets, which was limited to October 9, so the estimates are not directly comparable.
On October 11, Binance founder CZ alleged that hackers acquired CryptoBilis and used a nondisclosure agreement to silence its former operators, without providing supporting documents. Former founders Arravind Prabu and Vimalatheethan confirmed handing over operations in March 2026, but their statement did not establish that the buyers were responsible for the thefts.
On October 11, Ledger said all confirmed fund-draining cases involved CryptoBilis-sold devices and that its systems and direct sales channels remained unaffected. Ledger also reported reviewing authorized-reseller controls, advancing hardware protections, and working with authorities.
In an October 11 alert, PeckShield reported that approximately $3.89 million in incident-linked cryptocurrency had reached Binance deposit addresses on Tron during the preceding two days. Bitquery separately traced 5.2 million USDT in gross intermediary-wallet flows to Binance, cautioning that these included other clients’ funds; neither report confirmed Binance had frozen the deposits.
On October 10, Ledger confirmed that an affected user's device contained an unauthorized hardware implant, without identifying the model or establishing the implant's role in the losses. CryptoBilis also confirmed it had halted sales of all hardware wallet inventory pending the investigation, expanding beyond Ledger's earlier requested pause.
Ledger said it believed affected devices were limited to those sold through CryptoBilis in Southeast Asia. It reported no indication that its security infrastructure, systems, or services had been compromised.
A MistTrack-linked wallet transferred 468.9 ETH to an intermediary at 5:42 a.m. ET, which funded four addresses that made 23 Tornado Cash deposits totaling 464 ETH between 6:07:11 and 6:09:47 a.m. ET. The deposited funds were valued at approximately $1.16 million.
Bitquery reported tracing October 9 fund movements through Tornado Cash and Zcash using matching amounts and timing. It characterized those tracing links as strong evidence rather than proof.
Tether's first blacklist actions occurred at approximately 8:09 a.m. ET, according to Bitquery. TRON records confirmed that one recipient address holding 500,000 USDT was blacklisted; freezing the tokens restricted their movement but did not reimburse victims.
A wallet receiving funds traced from a MistTrack-linked address exchanged 2 million USDT for USDD through four 500,000-USDT transactions between 7:26 and 7:32 a.m. ET. The conversions preceded the incident's first blacklist actions and placed those funds outside Tether's USDT freeze controls.
On October 9, investigators observed 25 Tron wallets signing identical transaction authorizations within three seconds, which they assessed as indicating control by a single attacker or group. Bitquery also reported 41 preparatory test transactions on Tron and Ethereum between September 26 and October 7, 2026.
MistTrack estimated that reported losses associated with the CryptoBilis-linked incident were approaching $90 million and said its team was following up with affected users.
Ledger announced an investigation and asked CryptoBilis to pause Ledger device sales and shipments. Its notice advised customers who purchased within the preceding 90 days to delay initializing unused devices or consider moving assets to a new Ledger device with a new seed.
Ledger instructed all its retailers not to resell returned wallets to other customers amid reports of hardware implants in Ledger Nano X devices. The instruction extended beyond its previously reported suspension of CryptoBilis sales.
Tibane Labs examined compromised Ledger Nano X devices obtained through Amazon Japan from a China-based seller shipping from Malaysia and through Yahoo! Auctions Japan, reporting two seed-stealing implant variants. The findings documented tampered devices outside the identified CryptoBilis sales channel but did not establish a connection to its fund-draining incidents.
OneKey revoked CryptoBilis's reseller authorization and offered free replacements for all OneKey devices purchased from the reseller between March 1 and October 12, 2026; it reported no associated user losses but advised buyers against activating unused devices and urged asset transfers to newly generated recovery phrases. It also halted new reseller approvals and announced identity and ultimate-beneficial-ownership checks for every existing reseller.
Former Mt. Gox CEO Mark Karpelès posted photos and videos reportedly showing a circuit board hidden beneath the screen of a Ledger wallet he purchased in Malaysia, saying it arrived shrink-wrapped and passed Ledger's Genuine Check. He alleged that the implant captured displayed recovery phrases and transmitted them through an LTE modem with an e-SIM; Ledger had not confirmed that mechanism.
A Ledger user reportedly found a hardware implant in a wallet purchased in Europe. The supplied reference does not establish whether this report is connected to the CryptoBilis fund-draining incidents or whether the device caused any losses.
Joe Grand and Tibane Labs researchers reportedly reverse-engineered compromised Nano X wallets and identified three implant generations, including a concealed flex-PCB version linked to the CryptoBilis thefts. The implants allegedly captured recovery phrases from the internal display bus and exfiltrated them through cellular modems, leaving the Secure Element intact and allowing devices to pass Ledger's Genuine Check.
Bitquery estimated total thefts at $92.9 million, with 14.9 million USDT converted into USDD and approximately $10 million in USDT frozen across 20 wallets. These estimates did not establish how much victims would ultimately recover.
Ledger customers in Southeast Asia who purchased devices through reseller CryptoBilis reported lost funds. Affected users contacted MistTrack for assistance; the method used to steal the funds was not established.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
25 references tracked. Mallory keeps watching after this page renders.
thedefiant.io
Open sourceheise.de
Open sourcebleepingcomputer.com
Open sourcezdnet.fr
Open sourcethedefiant.io
Open sourcethedefiant.io
Open sourcetibane.net
Open sourceledger.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blockchain investigator ZachXBT reported infiltrating a Chinese cryptocurrency-laundering syndicate allegedly linked to North Korea’s Lazarus Group, exposing a wallet cluster containing more than $12 million in proceeds from the $1.5 billion Bybit theft. Posing as a customer, he funded transactions with 349,700 USDC and accepted a 5% loss per order to obtain private communications and transaction details. He correlated broker-provided wallets, gas funding, advance transaction disclosures and a THORChain transaction with public blockchain records to trace stolen assets across multiple networks. The FBI previously attributed the February 2025 Bybit theft to North Korea under the activity name TraderTraitor. Tether subsequently froze approximately **442,000 USDT** associated with the identified cluster; The Defiant independently confirmed the address’s blacklisted status onchain. ZachXBT said he immediately shared findings with private-sector investigators and law enforcement but delayed publication for roughly 18 months because of investigative sensitivities. His claims that the syndicate laundered more than $1 billion, processed most of the stolen Bybit assets and operated from Hong Kong and mainland China remain unconfirmed. The freeze restricts movement of the affected tokens but does not establish that funds have been returned to victims.
Oct 8, 2026
Cryptocurrency exchange **Bitget** confirmed that attackers stole approximately **$351.6 million** after gaining unauthorized access to part of its wallet infrastructure. The exchange detected unauthorized hot-wallet transfers at 18:31 UTC on September 24 and suspended withdrawals across its platform while it investigated with law enforcement and blockchain-security firms. Bitget CEO Gracy Chen said the incident was a direct breach of company systems or servers and said the exchange suspects North Korea-linked **Lazarus Group**, although it has not released technical evidence supporting the attribution. On-chain analysts initially observed roughly $165 million in ETH, stablecoins, and Tether Gold moving from Bitget-labeled wallets to a single externally owned address across Ethereum, Arbitrum, Optimism, and Base; the recipient later forwarded 19.67 million USDT0 received on Arbitrum. Bitget said deposits and trading remain available, customer balances are accurate, and its cold wallets and user private keys were not affected. It stated that its User Protection Fund, valued above $464 million, can cover the loss and pledged to publish a full incident report within 24 hours.
Oct 2, 2026
Tether froze more than **$344 million** in **USDT** held in two **Tron** wallet addresses after U.S. authorities identified the funds as tied to unlawful conduct. The company said the action was coordinated with the **Office of Foreign Assets Control (OFAC)** and U.S. law enforcement, blocking further movement of the assets once the addresses were flagged. The freeze adds to Tether’s broader enforcement activity as the stablecoin issuer reports more than **$2.1 billion** frozen in cooperation with U.S. authorities and over **$4.4 billion** frozen globally. Tether said it works with more than **340 law enforcement agencies** across **65 countries** and has supported over **2,300 cases** worldwide, including more than **1,200** involving U.S. agencies, as it expands compliance efforts through initiatives such as the **T3 Financial Crime Unit** with Tron and TRM Labs amid rising U.S. regulatory pressure on stablecoin issuers.
Jun 29, 2026