Don’t trust, verify. A proverb made for the Ledger affair. On Friday, the French manufacturer suspended its Southeast Asian reseller after $86 million was stolen from wallets. Twenty-four hours later, the file has thickened and the toll is climbing. Above all, the incriminated store changed owners this year with the greatest discretion, and a former boss of Mt. Gox claims to have found a spy in a device from Malaysia.
Ledger theft toll exceeds $92 million
The first figure came from on-chain investigator Specter, more than $86 million. Analytics firm Bitquery has since cast a wider net. His tally reaches $92.9 million siphoned from 311 wallets and five blockchains, including Bitcoin, Ethereum and Tron. A third score, signed John Kamal for Yfarmx, rises to 93.4 million spread across 471 addresses. Ledger has not validated any of these totals.
Money travels. Chainalysis says it has identified “a sophisticated cross-chain laundering operation.” Bitquery and Yfarmx statements document passages through Tornado Cash, this mixer which blurs the origin of funds. Tether has frozen around $10 million in USDT. At the end of Friday, nearly 79 million remained traceable on-chain according to Bitquery. In other words, investigators still see most of the loot without being able to touch it.
Ledger reseller CryptoBilis was sold in March
It’s the revelation of the weekend. Documents from the company register, relayed since Friday evening by several media including BitPinas, show that CryptoBilis was bought in March 2026. Since August 3, 100% of the capital has belonged to a certain Jiaming, domiciled in the Chinese province of Heilongjiang. A co-founder confirmed the sale. “We are no longer part of the company,” he wrote, asking the current management to manage the crisis with transparency. The founders say they have handed over all access and no longer have any visibility on operations.
Interestingly, a confidentiality agreement prohibited them from announcing the sale. Ledger therefore listed as an authorized distributor for Malaysia, Indonesia and the Philippines a company founded in Kuala Lumpur in 2020 whose control had changed hands. There is no indication whether the manufacturer was informed of this. Let's keep a cool head: at this stage there is no element linking the takeover to the thefts. CryptoBilis closed its stores in the three countries and suspended the sale of all brands, including Trezor and Tangem.
A spy module in a Ledger from Malaysia
The how remains. Mark Karpelès, the former French boss of Mt. Gox, published photos on Friday of a Ledger from Malaysia. Packaging intact. Under the screen, in place of the cushioning foam, it describes a second electronic card equipped with an LTE module, an eSIM and an antenna. The principle is disarmingly simple. The cookie reads what the screen displays during setup, then sends the 24 words of the recovery phrase over the mobile network. The device's secure chip sees nothing since no one attacks it. 23pds, head of security at SlowMist, describes the same pattern.
Two reservations are necessary. Karpelès clarified during the night that his devices did not come from an authorized reseller. He was investigating Ledgers being sold off on Amazon and other platforms, and two of them contained an implant. Ledger, for his part, has not commented on these photos. The manufacturer maintains its line: “We have no indication that Ledger’s security infrastructure, systems or services have been compromised. » Other scenarios remain on the table, such as devices preconfigured with a phrase known to the thief. The instructions do not change. If you purchased from this retailer within 90 days, do not configure the device. If it already is, migrate your funds to a new Ledger with a new recovery phrase.
