Invest Reports disagree 6 publishers 2 min read Published Oct 15, 2026, 2:32 PM PDT Updated Oct 16, 2026, 9:09 AM PDT

Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chains

Bitquery estimates $102 million was drained from 324 Ledger-linked wallets on six chains, up from about $86 million earlier. Ledger says its chips, software and servers were not breached and calls it a distribution-channel attack.

The Investor · Invest desk

Send a correction

Tether froze part of Bitquery's estimated losses USDT that Tether has frozen, as a part of Bitquery's $102 million estimate, in millions of dollars.

Reported USDT Tether has frozen, claim 15 $10 million of $102 million 9.8%
Reported USDT Tether has frozen The rest of the 102

Tether froze part of Bitquery's estimated losses
Share	Part	Whole	Percent	Claim
Reported USDT Tether has frozen	$10 million	$102 million	9.8%	15

What happened

On Ledger's account, criminals bought genuine devices, hid components inside and returned them to Southeast Asian channels, and the implants read 24-word recovery phrases during installation.
Bitquery says the affected devices came through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines.
Chainalysis found that a task-scam operator who moved proceeds into three Ledger wallets on September 22 lost more than 60 Bitcoin, about $4.8 million, on October 9.
Bitquery also traced coordinated fund movements, including $10 million in USDT that Tether has frozen, with other assets passing through Tornado Cash and THORChain.

Why it matters

Who's exposed exposure For a buyer holding a tampered device, a recovery phrase copied at installation was exposed from the first minute, and no later storage habit changes that.
Who has to decide decision Buyers and wallet makers now have to decide which sellers they trust, since the loss sits in who sold the device and two competing makers have already acted on resellers.
What doesn't add up contradiction Ledger's statement that its own chip, software and servers were intact and Bitquery's loss estimate can both stand, so a no-breach statement from a maker says little about whether a particular device is safe.

Next story · Invest · 3d ago

Ledger finds a cellular implant inside a CryptoBilis-sold signer that copies recovery phrases at setup

Confirmed8 publishers

The estimate is still moving. The revision from about $86 million to $102 million added $16 million, an 18.6% rise on the earlier count ^[20]^[13], and Ledger has not determined an overall loss number of its own ^[21]. Spread across 324 wallets, the figure is a mean of about $315,000 a wallet ^[12].

We think the reading that self-custody itself failed is half right. In its October 15 post, Ledger said none of its chip, operating system or servers had been breached ^[2]. What failed was the step before the owner's own handling began: a recovery phrase copied at installation was never private, whatever the owner did with the paper afterwards ^[3]. The assumption to revisit is that the device generating the keys is the device the maker shipped.

The counter-thesis is a narrow one. Bitquery traces the affected devices to a single reseller ^[4]. If every affected device traces to that reseller and no implanted unit turns up in stock sold elsewhere, the case for a broad rethink is weak and we are wrong. Two other outcomes would also change the view: Ledger's own total landing far from Bitquery's, or an implanted device from a second maker.

The task-scam operator's roughly $4.8 million is 4.7% of Bitquery's total ^[14], and Cryptopolitan notes the loss does not mean the operator's own victims recovered anything ^[5]. Tether's $10 million freeze covers 9.8% of the same total ^[15]^[8].

The closest base rate is TRM Labs' first-half count of 207 attacks and $972 million stolen ^[10]. Infrastructure and operational breaches were 15% of incidents but 76% of losses ^[11]. That works out to about 31 incidents and $739 million ^[16]^[17], an average near $23.8 million ^[18], against roughly $1.3 million for each of the other 176 ^[19]. The Ledger theft falls outside that half-year, and Cryptopolitan does not say how TRM would classify it.

The fixes reported so far act on sellers. Ledger told authorized resellers to stop displaying the device publicly and to hand it over only at the time of purchase ^[6]. OneKey parted ways with CryptoBilis, and Trezor will cancel certain resellers' authorizations starting January 1, 2027 ^[7], 78 days after Ledger's October 15 post ^[9]. A device already sold is outside all three.

What to watch

Ledger publishing its own loss total to set against Bitquery's estimate, which has already moved once.
Any implanted device found outside the CryptoBilis channel, since one would widen this beyond a single reseller.
Whether other wallet makers set cutoff dates for resellers of their own, as Trezor has for January 1, 2027.

Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence55
Adoption: Not scored
Hype gap+12
Incentives55
Confidence60

Perspective Coverage

6 publishers

Builder: Builder 23%
Operator: Operator 44%
Investor: Investor 33%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Chainalysis found that a task-scam operator moved proceeds into three Ledger wallets on September 22 and lost more than 60 Bitcoin, about $4.8 million, when the coins were moved on October 9 to a wallet already known to be used for stolen funds.
Reported Supported Source: Chainalysis, as reported by CryptopolitanView cited source
[2]
Ledger said in its October 15 post that its chip, operating system and servers were not compromised, describing the incident as a distribution-channel attack on devices sold through reseller CryptoBilis.
Reported Supported Source: Ledger's October 15 post, as reported by CryptopolitanView cited source
[3]
According to Ledger's statement, criminals bought genuine devices, hid components inside them and put the tampered devices back into Southeast Asian distribution channels; the implants could retrieve 24-word recovery phrases during installation, letting criminals access the wallets remotely.
Reported Supported Source: Ledger's statement, as reported by CryptopolitanView cited source
[4]
According to Bitquery, the affected devices were obtained via CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines.
Reported Supported Source: Bitquery, as reported by CryptopolitanView cited source
[5]
The task-scam operator's loss does not imply that the original scam victims recovered their money.
Reported Supported Source: CryptopolitanView cited source
[6]
Ledger advised authorized resellers to stop displaying the device publicly and to give it only at the time of purchase.
Reported Supported Source: Ledger, as reported by CryptopolitanView cited source
[7]
Trezor will cancel authorizations from certain resellers starting January 1, 2027, and OneKey decided to part ways with CryptoBilis.
Reported Supported Source: CryptopolitanView cited source
[8]
Bitquery's investigation found coordinated movements of stolen funds, including $10 million in USDT that Tether has since frozen; other stolen assets were traced through Tornado Cash and THORChain.
Reported Supported Source: Bitquery, as reported by CryptopolitanView cited source
[9]
January 1, 2027 is 78 days after Ledger's October 15 post.
Derived Supported
[10]
According to TRM Labs, hackers carried out 207 attacks in the first half of 2026, stealing $972 million.
Reported Supported Source: TRM Labs, as reported by CryptopolitanView cited source
[11]
Infrastructure and operational breaches made up 15% of the first-half 2026 incidents but 76% of total losses.
Reported Supported Source: TRM Labs, as reported by CryptopolitanView cited source
[12]
$102 million across 324 wallets is a mean of about $315,000 a wallet.
Derived Supported
[13]
The revision from about $86 million to $102 million added about $16 million, an 18.6% rise.
Derived Supported
[14]
The task-scam operator's roughly $4.8 million is about 4.7% of Bitquery's $102 million estimate.
Derived Supported
[15]
The $10 million of USDT Tether froze is about 9.8% of Bitquery's $102 million estimate.
Derived Supported
[16]
Infrastructure and operational breaches account for roughly $739 million of the $972 million stolen in the first half of 2026.
Derived Supported
[17]
Infrastructure and operational breaches were about 31 of the 207 incidents.
Derived Supported
[18]
The average infrastructure or operational incident cost about $23.8 million.
Derived Supported
[19]
The other 176 incidents averaged roughly $1.3 million each.
Derived Supported
[20]
Bitquery estimates $102 million drained from 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon, up from about $86 million previously.
Reported Contested Source: Bitquery, as reported by CryptopolitanView cited source
[21]
Ledger has not yet determined an overall loss number.
Reported Contested Source: CryptopolitanView cited source

Sources

6 independent publishers whose own reporting we read for this story.

coindesk.com
1 article · October 16, 2026
Scammer gets scammed in Ledger spy-chip exploit, loses almost $5 million in bitcoin
cointelegraph.com
1 article · October 15, 2026
Scammer loses $4.8M stored on tampered Ledgers: Asia Express
cryptobriefing.com
1 article · October 15, 2026
Ledger supply-chain attack drains over 60 BTC from wallet tied to alleged crypto scammer
cryptopolitan.com
1 article · October 15, 2026
Task-scam operator loses $4.8M in Bitcoin to Ledger implant theft
decrypt.co
1 article · October 16, 2026
Scammer Lost $4.8M in Bitcoin to Tampered Ledger Wallets: Chainalysis
news.bitcoin.com
1 article · October 16, 2026
Ledger Thieves Might Have a New Big Problem—Stealing From Criminals

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder23%

For people designing wallets and device pipelines, the useful detail is how little the attackers needed. Per Ledger, as relayed by Cryptopolitan and Decrypt, a physical implant read the recovery phrase from the screen during setup and sent it out over LTE. Ledger says its chip, operating system and servers were untouched, so the failure sat between factory and buyer. Cryptobriefing adds that the thieves waited until victims had loaded funds before draining many wallets within seconds. Cointelegraph reports that Ledger's new Atom device includes protections the company says would block these implants, which is Ledger's claim and has not been tested in our coverage.

Operator44%

The operational lesson is about resellers. Ledger asked authorized resellers to stop displaying devices and to hand them over only at purchase, then asked resellers in six Southeast Asian countries and Hong Kong to suspend sales, as Decrypt reports. Trezor will cancel some authorizations from January 1, 2027, and OneKey is dropping CryptoBilis. Cointelegraph says Trezor cited an inability to guarantee the same vigilance at distant resellers. Owners who bought from third parties are told to check the purchase date against Ledger's 90-day guidance, and Cryptobriefing notes that generating a new seed on a compromised device gives the attackers the new key.

Investor33%

The headline loss is an analytics-firm estimate, not a vendor figure. Bitquery says $102 million across 324 wallets, Cointelegraph prints $103.4 million from 530 addresses, Decrypt cites an unverified $86 million, and Ledger has no total. Cryptopolitan says the theft has not been shown to move crypto prices, and its TRM Labs figures suggest infrastructure breaches are a small share of incidents but most of the dollars. Cointelegraph and Bitcoin.com both note Ledger launched its $849 Atom device mid-crisis. Whether the reseller cuts rebuild confidence in self-custody is not something our sources can measure yet.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence55: 0100
Partly corroborated
The task-scam loss rests on a public Chainalysis post that several outlets reproduce, and the mechanism is backed by Ledger's own findings. The big numbers are weaker. The $102 million total is one analytics firm's estimate, rival tallies run from $86 million to $103.4 million, and Ledger has verified none of them.
AdoptionNot scored: No usage data
The reporting covers a theft and the vendors' responses. None of it gives device sales, user counts or the number of buyers who used CryptoBilis, so adoption cannot be measured.
Hype gap+12: −100 understated0 aligned+100 overstated
Mildly overstated
Most outlets attribute the $102 million to Bitquery and note Ledger's lack of a total, which keeps the framing close to the evidence. The headline still presents one estimate as the scale of the theft, and the loose Bitcoin and address tallies in some pieces push it slightly past what is verified.
Incentives55: 0100
Vendor framing interest
Ledger has a clear interest in locating the fault in a reseller channel rather than its own products, and it unveiled Atom, which it says blocks these implants, during the incident. Trezor and OneKey gain from distancing themselves from Ledger's channel problems. Analytics firms Chainalysis and Bitquery gain visibility from publishing findings, though nothing in our coverage shows their numbers are shaded.
Confidence60: 0100
Moderate
Six outlets agree on the core event and the mechanism, but they share few primary sources: Chainalysis's post, Ledger's statements and Bitquery's estimate. The loss total, scope beyond Asia and the first-half theft statistics each rest on a single or conflicting source.

Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chains

What happened

Why it matters

What to watch

Clarity's read

Claim ledger

Sources

Topics and entities

Topics

Entities

What happened

Why it matters

What to watch

Clarity's read

Claim ledger

Sources

Topics and entities

Topics

Entities

Related stories