Polygon

Tornado Cash

Read

TRON

Ethereum

<p><strong>A Ledger-related wallet drain has reached $92.9 million across Bitcoin, Ethereum and TRON, with on-chain forensics firm Bitquery tracing an updated $93.2 million from 315 wallets spanning six networks after a suspected supply-chain compromise tied to Southeast Asian reseller CryptoBilis.</strong></p>
<h2 id="what-the-ledger-related-wallet-drain-report-says">What the Ledger-related wallet drain report says</h2>
<p>Ledger Support <a href="https://x.com/Ledger_Support/status/2108551100613714002" rel="noopener noreferrer nofollow">confirmed it is investigating</a> reports of fund losses from users in Southeast Asia who purchased devices through a reseller named CryptoBilis, asked the reseller to pause all sales and shipments, and advised recent buyers not to initialize new devices or to migrate assets to a fresh signer using a new seed phrase. For related coverage, see <a href="https://www.marketbit.net/bitwise-ceo-dogecoin-etf-closure-solana-onchain-use-ai-etfs/" rel="noopener noreferrer nofollow">Bitwise CEO: Dogecoin ETF Closure Favors Solana’s Onchain Use</a>.</p>
<p>Bitquery's independent on-chain investigation <a href="https://www.bitquery.io/investigations/ledger-cryptobilis-hack" rel="noopener noreferrer nofollow">counted $93.2 million drained from 315 wallets</a> across TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana, a figure slightly above the $92.9 million headline estimate derived from 311 wallets across five networks. For related coverage, see <a href="https://www.marketbit.net/ethereum-etf-approval-demand-prediction-market-this-week/" rel="noopener noreferrer nofollow">Ethereum ETF Approval: Can It Drive Demand This Week?</a>.</p>
<figure style="margin:1.25rem 0;padding:1.25rem 1.5rem;border-left:4px solid #d97706;background:#fff7ed;border-radius:8px;">
 <div style="font-size:0.8rem;letter-spacing:0.08em;text-transform:uppercase;color:#9a3412;font-weight:700;">
  Bitquery total traced
 </div>
 <div style="font-size:2.5rem;line-height:1.1;font-weight:800;color:#111827;margin:0.35rem 0;">
  $93.2M
 </div>
 <figcaption style="font-size:0.9rem;color:#4b5563;">
  Across 315 wallets on TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana.
 </figcaption>
</figure>
<p>Bitquery observed two weeks of small test loops preceding the main drain, and wallet groups executing coordinated approvals or signature requests within seconds of one another, consistent with centralized control of seed phrases across all affected accounts. This pattern suggests the private keys were compromised at device setup rather than through a protocol exploit. For related coverage, see <a href="https://www.marketbit.net/price-analysis-near-xrp-shib-bitcoin-october-10/" rel="noopener noreferrer nofollow">NEAR, XRP, SHIB &amp; Bitcoin Price Analysis for October 10</a>.</p>
<p>Tether froze $10.0 million in USDT linked to the incident; separately, 1,254 ETH was routed through Tornado Cash and Zcash to later wallets, complicating tracing efforts on the Ethereum side.</p>
<h2 id="bitcoin-ethereum-and-tron-cross-chain-breakdown">Bitcoin, Ethereum and TRON: cross-chain breakdown</h2>
<p>TRON carried the largest share of the drain at $70.5 million, representing roughly 75.6% of Bitquery's total, consistent with the network's high concentration of USDT stablecoin liquidity among retail holders in Southeast Asia.</p>
<figure style="margin:1.25rem 0;padding:1.25rem 1.5rem;border-left:4px solid #0f766e;background:#f0fdfa;border-radius:8px;">
 <div style="font-size:0.8rem;letter-spacing:0.08em;text-transform:uppercase;color:#115e59;font-weight:700;">
  TRON share
 </div>
 <div style="font-size:2.5rem;line-height:1.1;font-weight:800;color:#111827;margin:0.35rem 0;">
  $70.5M
 </div>
 <figcaption style="font-size:0.9rem;color:#374151;">
  The largest chain-level amount in Bitquery's breakdown.
 </figcaption>
</figure>
<p>Bitcoin accounted for $16.8 million (approximately 203.8 BTC at the $82,715 spot price recorded at fetch time), Ethereum contributed $3.7 million, BNB Chain $1.45 million, Polygon $0.58 million and Solana $0.25 million to the cross-chain total.</p>
<p>The cross-chain dispersion across six networks within seconds of one another is a signal noted by Bitquery as evidence of coordinated, pre-staged key access rather than a sequential manual drain. Earlier reporting on <a href="https://www.marketbit.net/cz-urges-wallet-quarantine-after-86-million-ledger-reseller-hack/" rel="noopener noreferrer nofollow">CZ's wallet quarantine warning after the Ledger reseller hack</a> placed the initial estimate at $86 million before Bitquery's updated count extended the total.</p>
<h2 id="industry-reaction-and-open-questions">Industry reaction and open questions</h2>
<p>Changpeng Zhao assessed the incident as a supply-chain compromise localized to a single vendor, writing that "a small number of people probably bought fake (or tampered) Ledgers." His full statement:</p>
<blockquote class="twitter-tweet" style="margin:20px 0; padding:16px 18px; background:#0d1a0f; color:#f3f4f6; border:1px solid #00e676; border-radius:12px; margin:20px 0; padding:16px 18px; background:#0d1a0f; color:#f3f4f6; border:1px solid #00e676; border-radius:12px">
 <p>⚠️ Beware if you use a Ledger hardware wallet, especially if you bought one recently.<br><br>Based on information so far, it seems to be localized to a supply chain attack with one vendor. A small number of people probably bought fake (or tampered) Ledgers.<br><br>Ledger is one of the most… <a rel="noopener noreferrer nofollow" href="https://t.co/zW8wkvdZNf">https://t.co/zW8wkvdZNf</a></p>— CZ 🔶 BNB (@cz_binance) <a rel="noopener noreferrer nofollow" href="https://x.com/cz_binance/status/2108558560560918852?ref_src=twsrc%5Etfw">October 9, 2026</a>
</blockquote>
<p style="text-align:center;color:#888;font-size:13px;">Source: @cz_binance on X</p>
<p>According to unconfirmed industry assessment, counterfeit or modified Ledger hardware may have caused the drain; Ledger's forensic investigation remains open and the company has not confirmed the $93.2 million total, the precise attack vector, or whether core infrastructure was involved.</p>
<p>The <a href="https://www.marketbit.net/iphone-exploit-security-risk-crypto-holders/" rel="noopener noreferrer nofollow">hardware supply-chain risk vector</a> is distinct from protocol-level exploits: once a seed phrase is extracted at device initialization, all downstream wallets on any supported chain are fully exposed regardless of network-layer security. The $10.0 million USDT freeze by Tether represents the only confirmed partial recovery in the incident record so far.</p>
<p>Key open questions include the precise mechanism of seed-phrase extraction, whether CryptoBilis devices were counterfeit or tampered post-manufacture, the total confirmed victim count, and the recoverability of the 1,254 ETH routed through privacy protocols. The Fear &amp; Greed Index registered 64 (Greed) at time of publication, indicating market sentiment had not yet materially repriced hardware-wallet risk at an aggregate level.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px;">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.marketbit.net/?p=18530" rel="noopener noreferrer nofollow">Read original article on marketbit.net</a>

Ledger-Related Wallet Drain Reaches $92.9M Across BTC, ETH and TRON

Table of Contents

Marketbit

Other articles published on Oct 10, 2026

Crypto: Netflix’s FTX Series Sparks Outrage from Former Executive

Bitcoin Volatilitesi Düştü Ama Sert Hareketler Neden Arttı?

Ethereum Slips Below $2,500 as ETF Outflows Hit $542M: What Next?

Evernorth Completes SPAC Merger, Brings $473M XRP to Nasdaq

XRP ETF trading volume surges to $67.25 million, led by Bitwise and Franklin Templeton

XRP Is Setting Up for Something Very Interesting

Join our free newsletter for daily crypto updates!