Ledger-linked wallet drains exceed $86 million as losses keep climbing
Security & Exploits ·
Onchain analysts are tracking a suspected supply-chain compromise tied to Ledger hardware wallets that has drained more than $86 million from users, with the outflow still growing.
Reports circulating on X and Reddit describe wallet-draining activity affecting Ledger users, and onchain tracing of the addresses receiving stolen funds shows inflows from hundreds of separate victim wallets spread across Ethereum, TRON, and Bitcoin. Initial estimates put losses above $72 million before the figure rose past $86 million, and the total is described as still increasing as the attack continues. Several Bitcoin, TRON, and Ethereum addresses have been flagged as recipients of the drained funds, and holders who sent assets to any of them are being urged to come forward.
The affected devices appear linked to CryptoBilis, a reseller authorized to sell Ledger hardware, which changed ownership to a Chinese sole shareholder roughly two months before the thefts came to light. That ownership shift has drawn scrutiny given its timing relative to the disclosure, raising questions about transparency in the hardware supply chain rather than confirming any specific point of compromise.
Separate accounts in the same cluster describe alleged hardware implants found in counterfeit Ledger devices distributed through third-party resellers, and note that the drained wallets were largely tied to Southeast Asian customers who purchased devices through CryptoBilis. One analyst thread tracking the incident has also contributed to the running loss estimate, though no party has yet confirmed a direct compromise of Ledger's own infrastructure.
Eight distinct sources are now covering the episode, pointing to Ledger's ongoing investigation into the drains, the CryptoBilis acquisition, and the counterfeit-device allegations as parallel threads rather than a single confirmed cause. Until Ledger or independent researchers identify the precise mechanism, the exact entry point, the final loss total, and whether the compromise originated with counterfeit hardware, a reseller-side breach, or something else entirely remain unresolved.