Security

Element

Million

<h3 id="in-brief">In Brief:</h3>
<div>
 <div>
  <div>
   <ul>
    <li>Ledger is investigating reported cryptocurrency thefts exceeding $86 million and has instructed Southeast Asian reseller CryptoBilis to suspend device sales.</li>
    <li>Blockchain researchers traced suspicious transactions across three networks, while former Mt. Gox CEO Mark Karpelès investigates possible malicious hardware implants.</li>
    <li>Binance founder Changpeng Zhao warned about potential supply chain attacks, while Ledger advised affected customers to consider transferring their assets.</li>
   </ul>
  </div>
 </div>
 <div>
  <p>&nbsp;</p><br>
 </div>
</div>
<p>More than $86 million in cryptocurrency has reportedly been stolen from Ledger wallet users, raising concerns about a possible supply chain attack involving compromised hardware devices. <a href="https://x.com/Ledger_Support/status/2108551100613714002" rel="noopener noreferrer nofollow"><span>According to Ledger Support</span></a>, the company is investigating reports of stolen funds involving customers who purchased hardware wallets from CryptoBilis, a reseller operating in Southeast Asia.</p><br>
<h2 id="ledger-orders-cryptobilis-to-suspend-device-sales">Ledger Orders CryptoBilis to Suspend Device Sales</h2>
<p>Ledger has issued precautionary instructions to customers who purchased devices through CryptoBilis as it investigates the reported cryptocurrency thefts. According to the company’s announcement, customers who purchased devices from the reseller within the previous 90 days should avoid activating unconfigured wallets.</p><br>
<div class="embed-x">
 <blockquote class="twitter-tweet">
  <p>Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.…</p><br>
  <p>— Ledger Support (@Ledger_Support) <a href="https://x.com/Ledger_Support/status/2108551100613714002?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 9, 2026</a></p><br>
 </blockquote>
</div>
<p><span><strong>Also Read:&nbsp;</strong><a href="https://36crypto.com/visa-and-adi-foundation-explore-blockchain-links-for-global-payment-networks/" rel="noopener noreferrer nofollow">Visa and ADI Foundation Explore Blockchain Links for Global Payment Networks</a></span></p><br>
<p>Customers who already initialized their devices were advised to consider transferring their cryptocurrency holdings to new Ledger signers with different recovery phrases. The company also directed affected customers to its official support channels for assistance and further information regarding the investigation.</p><br>
<h2 id="researchers-trace-over-86-million-across-multiple-blockchains">Researchers Trace Over $86 Million Across Multiple Blockchains</h2>
<p>Blockchain researchers have identified suspicious cryptocurrency transactions involving hundreds of wallets, providing additional details about the scale of the reported thefts. <span><a href="https://x.com/SpecterAnalyst/status/2108534068564373687" rel="noopener noreferrer nofollow">According to blockchain investigator Specter’s October 9 analysis</a></span>, ten suspicious addresses received more than $86 million across Bitcoin, Ethereum, and TRON networks.</p><br>
<p>The researcher found that the identified addresses held approximately $25 million during the latest assessment, indicating substantial funds had already moved elsewhere. Another investigator, tanuki42, previously identified eight suspicious addresses and estimated losses exceeding $72 million from the reported incidents.</p><br>
<div class="embed-x">
 <blockquote class="twitter-tweet">
  <p>There have been a reports on X and Reddit of wallet-draining by Ledger users.</p><br>
  <p>I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin.</p><br>
  <p>Total losses $86M+… <a href="https://t.co/c5dhQeAZ0l" rel="noopener noreferrer nofollow">pic.twitter.com/c5dhQeAZ0l</a></p><br>
  <p>— Specter (@SpecterAnalyst) <a href="https://x.com/SpecterAnalyst/status/2108534068564373687?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 9, 2026</a></p><br>
 </blockquote>
</div>
<p>Specter’s subsequent findings included those eight addresses alongside two additional Bitcoin addresses, expanding the number of addresses associated with the suspected thefts. Security Alliance also urged affected cryptocurrency holders to contact its SEAL 911 service for assistance with tracing stolen assets and reporting suspicious transactions.</p><br>
<h2 id="former-mt-gox-ceo-investigates-possible-hardware-implants">Former Mt. Gox CEO Investigates Possible Hardware Implants</h2>
<p>The investigation has also drawn attention to potential hardware tampering, with former <span><a href="https://36crypto.com/mark-karpeles-to-launch-new-crypto-platform-ellipx-in-europe/" rel="noopener noreferrer nofollow">Mt. Gox CEO Mark Karpelès</a></span> examining whether malicious components were installed inside Ledger devices. According to Karpelès, he is investigating whether attackers physically modified Ledger hardware wallets before distributing them to customers.</p><br>
<p>He requested photographs of affected devices’ internal circuit boards to determine whether unauthorized components had been installed alongside legitimate hardware. His investigation also highlighted limitations in Ledger’s Genuine Check feature, which verifies device authenticity through its security architecture.</p><br>
<div class="embed-x">
 <blockquote class="twitter-tweet">
  <p>POSSIBLE SUPPLY CHAIN ATTACK BEHIND $86 MILLION LEDGER WALLET THEFTS</p><br>
  <p>Former Mt. Gox CEO Mark Karpelès is investigating whether malicious hardware implants were inserted into Ledger devices in a potential supply chain attack affecting customers in Southeast Asia.</p><br>
  <p>Ledger has… <a href="https://t.co/Zew4LAihRl" rel="noopener noreferrer nofollow">https://t.co/Zew4LAihRl</a></p><br>
  <p>— Bitcoin News (@BitcoinNewsCom) <a href="https://x.com/BitcoinNewsCom/status/2108566866759135651?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 9, 2026</a></p><br>
 </blockquote>
</div>
<p>Ledger’s documentation acknowledges that its verification process cannot identify certain unauthorized physical modifications when the original Secure Element remains intact. Karpelès has not confirmed the presence of malicious implants in affected devices, leaving the suspected supply chain attack unverified.</p><br>
<h2 id="binance-founder-cz-raises-supply-chain-security-concerns">Binance Founder CZ Raises Supply Chain Security Concerns</h2>
<p>Binance founder <a href="https://36crypto.com/changpeng-zhao-early-life-and-net-worth-the-vision-behind-binance-and-blockchain-innovation/" rel="noopener noreferrer nofollow"><span>Changpeng Zhao</span></a> also <span><a href="https://x.com/cz_binance/status/2108561409642574285" rel="noopener noreferrer nofollow">addressed</a></span> the reported thefts, suggesting that compromised devices distributed through a single reseller could explain the incidents. According to Zhao, preliminary information points toward a possible supply chain attack involving counterfeit or tampered hardware wallets.</p><br>
<p>He emphasized Ledger’s established security record while acknowledging that hardware devices remain vulnerable to interference during distribution. Zhao recommended that cryptocurrency holders exercise caution when purchasing wallets and avoid transferring substantial funds immediately upon receiving new devices.</p><br>
<div class="embed-x">
 <blockquote class="twitter-tweet">
  <p>One security tip.</p><br>
  <p>When you buy a hardware wallet (or download a new software wallet), leave it for a couple of weeks before moving any meaningful amount of funds to it.</p><br>
  <p>And follow the news in those weeks (and after), for hacks, etc. Hardware can be tempered with, software… <a href="https://t.co/TFsx64UihY" rel="noopener noreferrer nofollow">https://t.co/TFsx64UihY</a></p><br>
  <p>— CZ <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f536.png" alt="🔶"> BNB (@cz_binance) <a href="https://x.com/cz_binance/status/2108561409642574285?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 9, 2026</a></p><br>
 </blockquote>
</div>
<p>Changpeng Zhao expressed confidence that blockchain industry participants would assist investigators in tracing stolen cryptocurrency and supporting potential recovery efforts.</p><br>
<h2 id="what-this-means-for-ledger-users">What This Means for Ledger Users</h2>
<p>The unresolved attack method has left Ledger customers facing uncertainty over whether the reported thefts involved compromised hardware, malicious applications, or phishing attacks. Users should verify wallet software sources, avoid entering recovery phrases into computers or mobile devices, and carefully examine transactions before authorization.</p><br>
<p>If investigators identify compromised third-party applications or phishing schemes, stronger software verification and recovery phrase protection could help prevent similar incidents. A confirmed hardware or firmware vulnerability could require security updates or migration to newly configured devices with different recovery phrases.</p><br>
<p>Researchers are also <span><a href="https://36crypto.com/ostium-says-23-75m-exploit-stemmed-from-off-chain-infrastructure-breach/" rel="noopener noreferrer nofollow">monitoring suspicious cryptocurrency addresses</a></span>, including one reportedly holding 211 BTC, for further movements linked to the suspected thefts. The estimated $86 million loss remains independently reported rather than officially confirmed by Ledger, while additional victim reports could change the figure.</p><br>
<p>Ledger’s investigation remains ongoing, with the attack method, number of affected customers, and total confirmed financial losses still undetermined.</p><br>
<p><span><strong>Also Read: </strong><a href="https://36crypto.com/nasdaq-ceo-says-tokenization-could-unlock-billions-in-global-collateral/" rel="noopener noreferrer nofollow">Nasdaq CEO Says Tokenization Could Unlock Billions in Global Collateral</a></span></p><br>
<p>The post <a rel="noopener noreferrer nofollow" href="https://36crypto.com/what-we-know-about-the-86-million-ledger-drain-so-far/">What We Know About the $86 Million Ledger Drain So Far</a> appeared first on <a rel="noopener noreferrer nofollow" href="https://36crypto.com">36Crypto</a>.</p>

What We Know About the $86 Million Ledger Drain So Far

Table of Contents

36crypto

Other articles published on Oct 9, 2026

Join our free newsletter for daily crypto updates!