Ledger wallets emptied of $86 million: an Asian reseller in the sights

Funds are not safe? On Thursday evening, October 8, Ledger wallet holders reported cascading fund dumps on X and Reddit. In fact, the rises surged in a few hours. According to on-chain analyst Specter, cumulative losses would exceed $86 million. A few hours later, Ledger responded. Thus, the manufacturer points the finger at a reseller from Southeast Asia. There remains a major unknown, the vector of the attack.

The key points of this article:

Hundreds of Ledger wallets were allegedly emptied on Ethereum, Tron and Bitcoin, for a total estimated at more than $86 million.

Ledger mentions users in Southeast Asia who purchased their device from a reseller called CryptoBillis, whose sales are suspended.

The manufacturer recommends to recent buyers from this reseller not to initialize their device, or even to migrate to a new sign with a new seed.

Ledger has not confirmed any attack vectors at this point, and no one is pointing to any flaws in the devices themselves.

86 million dollars swept away in 48 hours

In fact, everything starts from serial reports. Starting Thursday, users claim to see their funds leave without any interaction on their part. Indeed, on-chain analyst Specter then traces more than 86 million dollars stolen from Ethereum, Tron and Bitcoin. In addition, some figures put forward on social networks even come close to the $100 million mark. As a reminder, on Bitcoin, three theft addresses would have accumulated no less than 211 BTC between October 8 and 9. Ledger says these funds remain immobile at the time of writing.

However, the matter remains shrouded in gray areas. Nobody knows the exact number of victims. Nothing demonstrates a flaw in Ledger devices at this stage.

The Trail of a Southeast Asian Dealer

For its part, Ledger responded on As a precaution, Ledger asked the latter to suspend all of its sales and shipments, pending the results of the investigation.

“Ledger is currently investigating reports of lost funds involving users in Southeast Asia who purchased products from a reseller named CryptoBillis. We recommend that Ledger users who have purchased from this reseller in the last 90 days do not proceed with setup if they have not already done so. »

Then the manufacturer's recommendations are clear. Customers who have purchased from this retailer within the last 90 days should not initialize their device if they have not already done so. Those who have configured it must migrate their assets to a new Ledger sign, with a fresh seed. A procedure which recalls the vital importance of the secret phrase, the only ultimate lock of a hardware wallet. Good news, Ledger is not requiring any drastic measures from other customers, whose devices remain usable normally.

For his part, CZ, the founder of Binance, supported this reading of the file. According to him, the incident “appears to be localized to an attack on the supply chain via a single seller”. A small number of buyers would have ended up with falsified or altered Ledgers. The boss of Binance defends the house in passing, believing that Ledger remains “one of the safest and oldest hardware wallets in the industry”. It now invites the entire BNB ecosystem, and the entire industry, to help trace and recover funds.