An investigation into cryptocurrency thefts affecting Ledger hardware wallet users has traced approximately $93.2 million across six blockchains, revealing how the suspected attacker moved assets through stablecoins, cryptocurrency mixers and exchange services while issuers attempted to restrict transfers.
According to blockchain analytics firm Bitquery’s October 11 investigation, the theft affected 315 wallets associated with devices purchased through CryptoBilis, a Ledger reseller operating in Southeast Asia. Most of the funds were drained on October 9.
Tether has frozen approximately $10 million in USDT across 20 wallets, while investigators identified another 5.35 million USDC in five addresses that Circle could potentially freeze. The latter funds had not been confirmed frozen as of the investigation’s latest update.
The $93.2 million figure is Bitquery’s estimate rather than a loss total independently confirmed by Ledger.
Stolen Funds Moved Across Six Blockchains
Bitquery identified approximately $70.5 million stolen on TRON, $16.8 million in Bitcoin, $3.7 million on Ethereum, $1.45 million on BNB Chain, $580,000 on Polygon and $250,000 on Solana.
The investigation found evidence of coordinated wallet activity, including 25 TRON wallets signing the same approval request within three seconds. Researchers also identified small test transactions conducted during the two weeks preceding the theft.
Ledger confirmed finding an unauthorized hardware implant in one affected device and asked CryptoBilis to suspend sales and shipments while investigating the incident.
The company said the reported losses appeared concentrated among devices sold through the reseller, rather than indicating a compromise of Ledger’s internal systems. However, investigators have not established whether the identified hardware modification explains every theft.
Following the initial transfers, approximately 14.7 million USDT was reportedly converted into USDD, a separate dollar-pegged stablecoin that cannot be frozen through Tether’s USDT blacklist.
That conversion complicated attempts to restrict the stolen assets, illustrating the limits of issuer-controlled freezing mechanisms when funds move between different cryptocurrencies.
Tether Freezes $10 Million as Circle Remains a Potential Intervention Point
Bitquery reported that Tether began blacklisting addresses shortly after the thefts became public. Of the addresses restricted, 20 collectively held approximately $10 million in USDT.
Meanwhile, the attacker reportedly transferred 2,990 ETH through Tornado Cash over October 9 and 10. Investigators traced subsequent movements through Zcash and NEAR Intents, identifying 5.35 million USDC across five wallets. Those holdings represent a potential intervention opportunity for Circle, which has the technical ability to block USDC transfers from designated addresses. However, their identification does not establish that Circle has taken action.
By approximately 06:00 UTC on October 11, Bitquery estimated that $81 million of the stolen assets remained traceable on-chain, down from approximately $88 million the previous day.
Investigators also identified approximately 203.8 BTC that remained unmoved and transfers involving intermediary wallets associated with Binance deposits.
The case highlights both the effectiveness and limitations of stablecoin freezing. Although Tether restricted $10 million, the remaining assets demonstrate how attackers can complicate recovery through cross-chain transfers, intermediary services and assets outside individual issuers’ control.
Importantly, frozen cryptocurrency is not automatically returned to victims. Recovery requires additional coordination, verification and potentially legal proceedings.