The Ledger CryptoBilis hack took $102.0M from 335 wallets. One thief had all the keys

01 · What buyers sawWeeks after setting up a Ledger, the money was gone

You buy a Ledger and move your savings onto it. Weeks later you open the app. The balance says zero, and you never sent a thing.

That is what Ledger owners in Indonesia, Malaysia and the Philippines found on Friday 9 October. Ledger says they had bought their devices from CryptoBilis, a shop that sells them in the region. Ledger's post spells it CryptoBillis in one place, and news reports describe it as an official reseller.

Ledger is a French company that makes hardware wallets, small devices that keep the keys to your crypto away from the internet. On the same day it said it was looking into losses among users in South East Asia who bought from CryptoBilis. It asked the reseller to stop all sales, told recent buyers not to set up their devices, and told anyone who had to "consider moving assets to a new Ledger signer (with new seed)".

By then two on-chain researchers had posted the thief's addresses. tanuki42 listed eight and Specter listed ten, with losses above $86 million. Bitquery records every transfer on the chains involved, so we followed each drained wallet and each address the money reached. Our count is $102.0M from 335 wallets on six chains. It is higher because the thief also emptied wallets on Solana, BNB Chain and Polygon, and used six TRON addresses that no public list includes.

The record points to one actor who held the keys to every one of those wallets. That person practised for two weeks before the drain, and by the evening was feeding the money into a mixer, a service that hides where coins go. The chain cannot show where the keys leaked from. It can show almost everything else.

02 · The key to a crypto walletWhoever has the 24 words owns the coins

When you set up a Ledger, it shows you 24 words, called the recovery phrase. Those words are the master key to your wallet. Anyone who has them can rebuild the wallet on another device and spend from it, on any chain, without touching your Ledger.

The device's job is to make sure nobody else ever sees those words. That is why Ledger tells buyers to buy only from Ledger or an authorised seller, and CryptoBilis was listed as one. A device that arrives opened, or with words already printed on a card, should never be used.

On 10 October Ledger said one victim's device "contained an unauthorized hardware implant". That is the first confirmed cause, and it covers one device so far. On 13 October Ledger's security lab, Donjon, explained how it works. The implant sits inside the case and reads the screen. When the device shows the 24 words during setup, the implant decodes them and sends them out over the mobile network through a built-in SIM. It does not touch the secure chip or the device's software, and it does not change transactions or signatures. Before that, some well-known figures, including Binance founder CZ, had suggested tampered devices. Hardware wallets have been hit before, as in the Coldcard wallet theft we traced earlier this year. Each case had its own cause. What the chain does show is what happened once the thief had the keys.

03 · Forty-seven minutesThe thief hit six chains in one morning

The first money moved on TRON, a network that many people in Asia use to hold and send USDT, the digital dollar issued by Tether. Within 47 minutes the same thief had emptied wallets on Ethereum, BNB Chain, Polygon, Solana and Bitcoin. The full TRON record is in Bitquery's TRON data and the TRON history files on the Data Store.

Most of the money left in the first hour. Then the drains slowed. The thief kept emptying wallets through the afternoon, including after Ledger's post. At 20:49 UTC it emptied nine more in a single block, 8.8 million USDT in all. On 10 October it took 70,000 USDT more from a wallet it had already emptied.

04 · One person, all the keysTwenty-five wallets signed the same request within three seconds

On TRON the thief did not send each wallet's USDT straight out. First, each wallet signed an approval, a short note that lets another address move its USDT. Then one address used those approvals to pull the money.

The record shows 25 wallets signing the same approval for the same address in two blocks, three seconds apart. Every one of them paid its own small network fee. Within six seconds of the first approval, $29 million in USDT had been pulled out, 7 million USDT of it from a single wallet.

Eleven seconds after the first TRON approval, two Ethereum wallets signed the same kind of approval for a different address, and a third followed twelve seconds later. On Bitcoin, 111 wallets were emptied in a single block at 05:54 UTC, each into one of two addresses at nearly the same fee rate. People do not act like this. Software that already held every key does.

Eight minutes before the approvals, the thief had done something quieter. At 04:59:57 UTC, 30 other TRON wallets changed who controls them, all within three seconds, each paying a 100 TRX fee. Each change added the same new key, TEqZsE…ZxpK, with enough weight to move the coins on its own. The owner's own key was left too weak to act alone. Only a wallet's own key can make that change, so whoever made it already held all 30. The owners were locked out. At 10:26 the thief came back and emptied all 30 in under four minutes, $5.8M in USDT. One more wallet had been taken over an hour earlier, at 03:55, with a second key, which the thief's approval address later sent 100 TRX. That wallet lost 4.3 million USDT at 09:49.

There is one other way to get the same picture. A phishing site could collect signed requests from many people over a day and send them all at once. We tested that idea and rate it unlikely. A signed request to send coins names the exact amount. One business wallet sent its whole balance, 4.3 million USDT, to the thief at 09:49 UTC. It was the wallet taken over at 03:55, and its balance had not changed in between, so the thief already controlled it; nothing about it needed a request signed in advance. A phishing site would also have needed signatures from 335 wallets on six chains, and the drain was in full swing within an hour.

05 · The practice runsTwo weeks of small tests before the drain

The address that pulled the USDT on TRON was set up on 25 September. Three minutes earlier, the address that did the same job on Ethereum got its first money.

For the next two weeks both ran the same test. Send a wallet a few dollars and some gas, the coin it needs to pay network fees. Have that wallet approve. Pull the dollars back. The TRON address did it 21 times and the Ethereum address 20 times. The last two tests, on 7 October, ran 23 seconds apart.

One test, on 2 October, pulled its three dollars into an address that later took $36 million on the day of the drain. The plan was in place a week before anyone lost a coin.

06 · How much was takenMore than first counted, on more chains

We counted only money that left a victim's wallet. That leaves out swaps the thief made later and money moved between the thief's own wallets, which some early totals counted twice.

On Bitcoin, Ethereum and TRON, the ten public addresses received $85.4M, close to Specter's estimate. Three amounts are in no public tally. The thief took $2.0M on BNB Chain and Polygon, into the same three addresses it used on Ethereum. On TRON it used six more addresses to drain $15.1M, three of them after Ledger's post. The last, $0.25M, came from Solana.

Between 05:38 and 05:56 UTC the thief emptied four Solana wallets of 1,355 SOL and 100,000 USDT into three fresh addresses. Through Relay.link and NEAR Intents the money became ETH and landed in three of the thief's Ethereum wallets. The two services' public records tie each deposit to its payout. A fifth wallet, which the thief swept of a few cents of SOL at 06:05, had 272 SOL staked. Whoever holds its key can unstake those coins and take them, which takes up to about a day.

One public list also names a third Bitcoin address. It behaved differently, and we leave it out. It started two days earlier, drained old wallets one at a time, paid much lower fees and shared no wallets with the main two. It took 9.6 BTC from 154 addresses, about $0.8M of the $85.4M above. Early on 10 October it sent all of it on to fresh addresses.

07 · Who lost moneyMost wallets were new, but not all fit Ledger's 90 days

Ledger's advice covers people who bought from the reseller in the last 90 days. We checked when each TRON, Bitcoin and Ethereum victim wallet first received money. Of those wallets, 6 in 10 got their first coins inside that window, and more than 8 in 10 got them from June onward.

June stands out. In that month alone, 43 TRON victim wallets got their first coins, just before the 90-day line. A wallet's first payment is not the day its owner bought a device, so this is not proof. But it suggests the risk may reach back about four months, and owners who bought in June should treat Ledger's advice as theirs too.

The money came from the places you would expect for buyers in the region. Bitcoin victims had been paid from Binance, Indodax in Indonesia, OKX and Bybit. Two victims were already named on X by Lookonchain, and the record backs both. One TRON wallet, first funded on 15 September, lost 7 million USDT in the first wave. One Bitcoin wallet got 80 BTC on 29 September and lost all of it in the block at 05:54.

At least one victim was a business. One drained TRON wallet had taken in 33.5 million USDT since 1 October and paid most of it out again to 29 different wallets, the pattern of a business.

Not every victim was an ordinary buyer. On 15 October Chainalysis reported that one of the larger Bitcoin victims was running a task scam, in which people were paid to fake sales and reviews and then told to pay in money of their own. The part we can check on the chain matches. Three of the drained Bitcoin addresses each got two equal payments from one wallet on the evening of 22 September, and the thief emptied all three in the big Bitcoin block of the drain, 60 BTC in all, about $4.9M.

08 · Where the money wentInto bridges, swap services and a stablecoin Tether can't touch

Almost all the TRON money was in USDT, which Tether can freeze. The thief moved fast to get it out of reach, and in the first hours the dollars scattered.

The biggest share, 20 million USDT, crossed to Ethereum in 40 equal pieces through the USDT0 bridge, a service that moves USDT between chains. Five fresh wallets swapped it on UniswapX for 7,994 ETH. Another 23.7 million was swapped into USDD, a different stablecoin that Tether cannot freeze. Most of the rest went through swap services such as Relay.link, Chainflip, HiFiSwap and NEAR Intents, which paid the thief back in ETH. We traced the same pattern in the NEAR Intents theft and the $110 million TRON laundering case. Each payout here can be followed wallet by wallet with the Bitquery MCP.

09 · Where it sat on 10 OctoberAbout $97M could still be found

These are the balances at 07:00 UTC on 10 October. The Bitcoin had not moved since it was taken. The largest pile was about 17,247 ETH in 16 wallets on Ethereum, most of it bought with the stolen USDT. About 1,590 ETH came through Chainflip, a swap service, and nearly all of that sits in one wallet that has never sent a transaction. The 23.9 million USDD sat in nine wallets on TRON. That is a little more than the USDT swapped in section 08, because the thief also turned stolen TRX into USDD. The coins that went through Tornado Cash sat in three more wallets: 384 ETH and 2.1 million USDC. That left about $5M that had been spent through other services or that we have not yet followed to the end. By 14:40 UTC on 16 October, the money we can find had fallen to $81M. You can watch any of these wallets yourself with the Bitquery MCP, and the full histories are sold as files for Bitcoin and Ethereum.

10 · Tether's freeze, then the mixer$10.0M frozen, and the mixed coins found again

Tether can block any address that holds its USDT. About ten minutes after the first public post, it started blocking addresses linked to the theft, 37 of them over the next two hours. Twenty still held half a million USDT each, so $10 million is now stuck. A block stops the coins moving. It does not send them back to victims, though Tether can later destroy blocked coins and reissue them. News sites reported the freeze the same afternoon.

At 15:30 UTC Tether lifted the block on four wallets. They are THORChain's TRON vaults, the addresses where the THORChain swap service takes in USDT from many users. The thief had sent them about $3.0M to swap into ETH, and the ETH went to two wallets that then funded several of the thief's holding wallets.

From 15:17 UTC the thief began sending ETH into Tornado Cash, a mixer that breaks the link between the wallet that pays in and the wallet that later takes out. Three batches of about 400 ETH each went in within 40 minutes, 1,254 ETH in all. The mixer hid little. Withdrawals matching each deposit, pool for pool, went to six fresh wallets, the first of each batch within about a minute.

Those wallets swapped the ETH into Zcash in 41 lots. Zcash can hide the sender, receiver and amount of a payment. But 39 of the 41 lots came out again as two equal payments, and their amounts match the lots that went in, down to the smallest unit of Zcash. The other two were tiny test lots. By 19:53 UTC the coins had been swapped back and sat in three new Ethereum wallets: 384 ETH and 2.1 million USDC. Circle, which issues USDC, could freeze that part. A mixer means the link cannot be proven outright, but we rate it strong. The analyst YFarmX found this path first, and we checked it against our own data. Our Tornado Cash audit explains how the mixer works.

11 · Since 10 OctoberThe stablecoins went into ETH, and the mixing went on

The money we can find on the chain fell from $97M at our first count to $81M six days later. Most of the difference is money still passing through Tornado Cash and Zcash, or paid to a busy payment wallet and swap services.

On 10 October four of the thief's Ethereum wallets sent out 1,754 ETH. One of them, 0xc322…4065, was missing from our first count. It got 794 ETH the day before from the same two wallets that paid three of the thief's known holding wallets, and our figures now include it. Most of that ETH went into Tornado Cash in two runs. Matching withdrawals started within minutes and went on to NEAR Intents in 28 lots, which swapped each lot into Zcash. Each lot came out of Zcash's private pool as two equal halves that together kept 99.75% of the lot. NEAR Intents then paid USDC for each half into four new wallets, 4.29 million USDC in all. YFarmX spotted two of the four wallets first.

That USDC did not wait for Circle. Within two days all five USDC wallets had emptied, including the first one. Most of it, 3.23 million USDC, went to a busy payment wallet that had also taken 1.06 million USDC from the thief a day earlier. The thief swapped another 1.73 million USDC into 675 ETH and sent the rest to the swap services Aeroswap and Bridgers. The ETH moved again on 14 October, most of it into USDT on TRON through the same payment wallet.

The stablecoins on TRON took another road. The thief turned its USDD back into USDT through single-use addresses and sent it to THORChain's vaults, each time with a note naming the Ethereum address that should get the ETH. Counting the swaps of stolen USDT on the first day, it sent THORChain 26.9 million USDT in 34 swaps, and THORChain paid out 10,636 ETH. Most of that ETH, 8,934 ETH, still sits in seven new wallets, and some of it went into Tornado Cash. One of the seven also holds ETH that came back out of Tornado Cash. The thief sent its last 2.0 million USDD the same way, so no USDD is left on TRON.

The mixing went on. Over the next six days the thief put about 4,710 ETH more into Tornado Cash. By our last check, 2,290 ETH had come back out and gone through NEAR Intents into Zcash's private pool.

On the afternoon of 12 October the thief took about 1,210 ETH back out of Tornado Cash. Most of it passed through a middle wallet into the new address that THORChain paid for the thief's last USDD swaps. That address now holds 1,944 ETH. So the withdrawals we had matched to the thief by their pattern meet its THORChain money in one wallet. On 13 October the thief also swept the last ETH, worth under $200, from two of its public drain addresses on Base into the wallet that fed Tornado Cash that morning, which puts the drain keys and the Tornado runs in one person's hands. Since 15 October it has also used Railgun, another privacy tool, though only for small sums. Nothing has come back out of Tornado Cash in the thief's pattern since 12 October. We estimate that about 1,190 ETH of its coins is still inside Tornado Cash.

Three fresh wallets got what came out of Zcash. NEAR Intents paid them 3.63 million USDC on 11 and 12 October, each batch starting within hours of one of the thief's Zcash deposits, as on 10 October. For one of the three, each payment matches one half of a pair of equal Zcash withdrawals. By the next morning one more pair of the same kind had come out, and together the pairs add up to 99.6% of what the thief put into Zcash that evening. Around midday on 12 October another of the three sent its 1.25 million USDC to a new wallet, which swapped it into ETH through the Bitget Wallet route the thief had used that morning. The third got gas four minutes later. Two days on, the wallet that paid that gas took 402 ETH straight from one of the thief's own wallets, and it also paid gas to the wallet whose payments matched the Zcash halves. On 14 October the wallet that had cashed out sent its leftover ETH to the wallet that collected the third one's USDC, moments after the third did the same. That ties all three to the thief.

Circle did not freeze the 2.38 million USDC that the other two wallets held, and the thief then moved it. Most of it went to TRON as USDT through the busy payment wallet, which takes USDC on Ethereum and pays USDT on TRON, and through Bridgers, deBridge and Aeroswap. With the ETH from the swapped USDC, about 2.77 million USDT reached new TRON wallets. From there most of it went into busy TRON wallets that behave like brokers: they take a client's money, round it up and pay it out in pieces. The thief swapped 554,000 USDC into ETH. On 15 and 16 October the thief sent the rest of the collecting wallet's USDC and ETH, and the 488 ETH bought with the 1.25 million USDC, to TRON as another 2.06 million USDT. Most of it went through a chain of broker wallets within minutes. One lot of 2.0 million USDT stopped in a single storage wallet of that network, which also holds other clients' money; between 0.6 and 2.0 million USDT of what it holds is the thief's. Some of it may have reached Binance deposit addresses: up to 0.37 million USDT by the tracing rule we use, but close to none if the oldest money in each broker wallet is counted as leaving first. At our last check 200,000 USDC and 93,000 USDT still sat in the thief's own wallets, where Circle and Tether can freeze them.

One victim lost money again. The thief still holds the key of a TRON wallet it emptied in the drain. That wallet's usual payer had sent it USDT every day since 4 October and kept paying after the drain. The day after the drain, 70,000 USDT arrived in the afternoon, and ten minutes later the thief pulled it out through the USDT approval the wallet had signed the day before. No payment has arrived since. On 13 October Binance paid USDT into another drained wallet, and the thief holds that key too. Two days later, after a second payment arrived, the wallet itself sent all its USDT to a wallet its owner had paid in July, most likely the owner moving it out. A drained wallet stays in the thief's hands, so anything sent to it can be taken again.

On Solana, someone using the key of the fifth wallet, most likely its owner, unstaked all six of its stake accounts. Binance had sent the wallet a little SOL for fees four minutes before the unstaking began. Late on 11 October the first 44.5 SOL went to a Binance deposit address first used in February 2024, at the exchange that had also paid this wallet in April. The other 228 SOL went the same way a day later.

Nothing else moved: not the Bitcoin, and nothing on BNB Chain or Polygon. Apart from the one victim above, we found no new drains.

12 · The leadsWhere investigators could ask for records

The chain can't name the thief. It does show places that keep records about their users.

Circle and Tether can still act, on less money than before. The thief moved the USDC we had flagged before Circle could freeze it. About $0.3M still sits in the thief's own wallets. Most of the USDT the thief has sent to TRON since it moved the USDC went to brokers there, who may know their clients. One broker wallet still holds between 0.6 and 2.0 million USDT of it.

The strongest lead to the person behind this is how the gas was paid for. The TRON address that ran the drain was funded from an address that had withdrawn 14,512 TRX from Bybit the day before. An exchange that sends a withdrawal knows the account it came from. The Ethereum side was funded through Aeroswap, an instant swap service, five minutes after that withdrawal. Other leads are weaker. Money from an exchange shows where funds came from. It does not show who owns the wallet that got them. The same caution applies to a trader who received the thief's BNB and moved it to Gate.io. We show how such dead ends happen in our piece on an $812 million wallet nobody flagged.

On the day of the drain, none of the thief's wallets carried a theft label in the label sets we use, so an exchange screening deposits against such labels would not have caught this money. Late on 12 October our label set marked 32 of the 37 TRON wallets Tether had blocked. The thief's other wallets, including those holding the ETH, still carry no theft label.

13 · What we know and what to doOne implant confirmed. The rest is still open

Here is what the chain settles. One actor held the keys to every drained wallet. It tested the method for two weeks, locked 31 owners out of their TRON wallets, then ran the drain across six chains in under an hour. Here is what it can't settle: how each wallet's keys leaked. Ledger has found an implant in one device and has shown how it copies the 24 words at setup. Ledger says all confirmed losses involve devices sold through CryptoBilis, and it is looking into reports of implants in devices bought elsewhere. On 13 October the electronics chain MediaMarkt Saturn stopped selling Ledger devices after a customer in Germany reported an implant. Ledger said no loss of funds was reported in that case. Later that day Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to stop selling its devices and take them off the shelves while it finds out where in the supply chain the tampering happened. Whether every drained wallet came from a tampered device, or some keys leaked another way, will come from Ledger's look at more devices. Ledger has not confirmed how much was lost in total, and has not checked our count.

If you bought a Ledger from CryptoBilis, follow Ledger's advice, even if you bought it before July. Don't set up a device you have not used yet. If you already use one, set up a new device with a new recovery phrase and move your coins to it. Never use a device that arrives with words already written down. If you hold USDT on TRON, check your wallet's permissions in a block explorer. A key you do not recognise means someone else now controls the wallet. If your wallet was drained, ask anyone who pays into it to stop, because the thief still holds the key. Ledger says it will never call or message you or ask for your 24 words, and scammers often target victims after a theft like this. Similar lessons came out of the Bitget hack and the TradeWiz drain: once someone else holds your keys, the coins can be gone in seconds.

14 · How we did thisMethod

We started from the ten addresses posted by tanuki42 and Specter. We read every payment into and out of them on TRON, Bitcoin, Ethereum, BNB Chain and Polygon from Bitquery's data, and followed the money until it reached a service, a frozen wallet or a wallet that has not moved. On Solana, which no public list covered, we matched Relay.link and NEAR Intents payouts into the thief's Ethereum wallets to Solana deposits, then traced those deposits back to the wallets that were drained. Solana victims whose money took another route would not show up this way. For swaps we also read the public order records of Chainflip, Relay.link and NEAR Intents, and for Zcash the visible side of each payment. We left out money the thief moved between its own wallets, payouts from swap services, and fake tokens sent by scammers who copy addresses. Dollar values use prices from the morning of 9 October. A second, independent check rebuilt every figure from the raw data without seeing our notes. The data stops at 14:40 UTC on 16 October, except for the dated moves in the box at the top. The thief may have moved since. Our address poisoning study explains why copied addresses fill these wallets with fake transfers, and Bitquery's address labels are the label set we checked first.

FAQ

Was Ledger hacked?

Ledger says its own systems show no sign of a breach. On 10 October it said one victim's device "contained an unauthorized hardware implant", and on 13 October it said the implant copies the 24 words off the screen during setup. Wallets of people who bought Ledger devices from the reseller CryptoBilis were drained by someone who held their keys, and CryptoBilis has stopped selling hardware wallets while Ledger investigates.

What is CryptoBilis?

CryptoBilis, also spelled CryptoBillis, is a crypto hardware shop that sells Ledger devices in Indonesia, Malaysia and the Philippines. News reports describe it as an official Ledger reseller. On 9 October 2026 Ledger asked it to stop all sales and shipments of Ledger devices while it investigates.

How much was stolen in the Ledger CryptoBilis hack?

We count $102.0M taken from 335 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. Most of it was USDT on TRON. Early counts of about $86 million covered only the ten public addresses.

Can a Ledger be hacked?

The device is built so the recovery phrase never leaves it. If someone else gets that phrase, they control the wallet without the device. That can happen through a tampered device, a pre-printed recovery card, a fake app or a phishing site. In this case the thief clearly held the keys. Ledger found a hardware implant in one victim's device that reads the 24 words off the screen during setup and sends them out over the mobile network. Whether every key leaked that way is not yet known.

Is my Ledger safe if I bought it from a reseller?

If you bought from CryptoBilis, follow Ledger's advice: don't set up an unused device, and move your coins to a new device with a new recovery phrase. Many victim wallets were first funded in June 2026, before Ledger's 90-day window, so earlier buyers should take the same step. MediaMarkt Saturn in Europe also stopped selling Ledger devices on 13 October after one implant report, while the investigation continues. If you bought a Ledger from any reseller in Southeast Asia or Hong Kong, Ledger has asked those sellers to pull their stock, so treat an unused device from them with the same care.

Can the stolen crypto be recovered?

About $10 million in USDT is frozen by Tether, which can later reissue frozen coins. The Bitcoin has not moved, and most of the ETH still sits in known wallets. The first USDC that came out of the mixers was moved on before it could be frozen, and the thief later moved the USDC we flagged as well. About $0.3M in USDC and USDT still sits in the thief's own wallets, where Circle and Tether can freeze it. The thief sent all its USDD through THORChain to be swapped into ETH.

Is this the same as the 2023 Ledger hack?

No. In December 2023 a fake version of Ledger's Connect Kit code library drained people who used certain crypto websites for a few hours. In 2020 a breach exposed customer emails and home addresses. This case is different: the thief held the recovery keys of hundreds of wallets and emptied them directly.