Bitcoin theft, 100 million stolen via a Ledger USB stick

A loot of 100 million dollars, but in bitcoin. Corriere della Sera reports it and defines it as the "(IT) robbery of the century". At the center of the theft are devices from Ledger, a French company that produces them specifically for cryptocurrencies.

The story

According to what the Corriere reports, the story begins in Malaysia, where CryptoBilis is based, a shop specializing in cryptocurrency wallets, founded in 2021 by two entrepreneurs, Arravind Prabu and Vimal Selvamany and which over time has become one of the main authorized Ledger resellers in South-East Asia. In March 2026, the two founders sold the company and abandoned all operational roles, passing 100% of the shares into the hands of a mysterious Chinese citizen, with a registered address in Heilongjiang province, in north-east China. Meanwhile, modified Ledger Nano X devices are entering circulation, completely indistinguishable, at least in appearance, from the originals.

The scam technique

A hardware wallet is a small electronic device with a screen that contains the keys necessary to use bitcoin and other cryptocurrencies, which are not physically inside it, outside the Internet and therefore without the risk of incurring cyber attacks. When you configure a new device, a sequence of 24 words appears on the screen, which allows you to recover your wallet on any other device. Here is the idea of ​​the scam: spying on what appears on the screen when the owner configures the wallet. A tiny clandestine electronic card is then inserted, connected to the circuits that transmit the information to the screen, which records the 24 words and sends them remotely.

How it was discovered

According to the Corriere, it was Mark Karpelès, former CEO of the Japanese platform Mt. Gox, who discovered the scam by dismantling a Ledger from Malaysia. According to Karpeles, "a vendor in Europe is still selling spy Ledger. This means the problem is far from limited to CryptoBilis."

The "robbery of the century"

The robbery actually takes place on Friday 9 October 2026, when someone begins to empty hundreds of electronic wallets at the same time. In less than an hour, wallets containing bitcoin, Ethereum and other cryptocurrencies are hit. According to the calculations made, 102 million dollars were stolen from 324 wallets on six blockchains. Ledger intervenes publicly, opens an investigation and asks CryptoBilis to immediately suspend sales and shipments.