Blockchain analytics firms have traced as much as $93.2 million stolen from wallets linked to Ledger hardware devices sold by authorized Southeast Asian reseller CryptoBilis, and Tether has frozen $10 million in USDT connected to the theft, according to on-chain data cited by intelligence firm Bitquery.

Ledger said Sunday that investigations remain underway, three days after the incident was first reported. The company confirmed it found an unauthorized hardware implant in at least one affected device. It did not say whether the drained wallets were compromised through the same implant or how the tampering occurred.

How large is the theft?

Bitquery put the traced total at $93.2 million, saying attackers stole mostly USDT and TRON tokens from 315 wallets across six blockchains. Security research platform YFarmX reported a higher figure: $94.5 million taken from 521 addresses across seven blockchains. Both estimates derive from public blockchain data rather than a confirmed loss total from Ledger itself.

Ledger did not immediately respond to a CoinDesk request to confirm the amount stolen or say whether it is considering a reimbursement plan for affected customers.

The Tether freeze, confirmed by Bitquery, matters because stablecoin issuers can blacklist tokens linked to criminal activity — a capability that does not exist for native assets like bitcoin or ether. As of Oct. 11, roughly $81 million could still be traced on-chain, while some of the stolen funds had moved through Tornado Cash and Zcash, according to Bitquery. Tether did not immediately respond to a request for comment on the freeze.

What does the hardware implant mean?

The confirmed implant distinguishes this incident from Ledger's recent security troubles. In April, a phishing campaign built around a fake Ledger Live app on Apple's App Store drained at least $9.5 million after users typed their recovery phrases into the fraudulent software. This time, the attacker appears to have obtained the keys needed to empty hundreds of wallets directly, without phishing victims one by one.

That difference has operational consequences. A supply-chain compromise at a reseller implies the tampering happened before devices reached customers, shifting scrutiny toward logistics and vendor vetting rather than user error. Ledger has not detailed at what point in the chain the implant was introduced.

Why is Ledger's framing contested?

Ledger says every confirmed case involves devices sold by CryptoBilis, framing the incident as limited to that reseller. Critics argue the framing sidesteps the company's responsibility, because CryptoBilis appeared on Ledger's own website as an authorized seller.

"It's not a CryptoBilis incident, it's a Ledger incident," X user MyCryptoParadise wrote. "At least take ownership of this mess."

The dispute cuts to a structural question in hardware-wallet distribution: when a manufacturer authorizes a channel partner, customers reasonably treat the partner's devices as equivalent to factory-direct units. If tampering occurs inside an authorized channel, the boundary between a reseller problem and a manufacturer problem becomes largely a matter of brand optics rather than customer risk.

What should affected customers do?

Ledger issued concrete guidance for CryptoBilis buyers:

• Do not set up unused devices purchased from the reseller.
• If a device is already in use, transfer all assets to a new device with a newly generated recovery phrase.

The company has not announced timelines for completing its investigation, a full loss accounting, or any remediation fund. With roughly $81 million still traceable on-chain and issuers able to freeze only stablecoin leg,, the recoverable share of the stolen funds will depend heavily on how quickly investigators and exchanges act before remaining assets are laundered through privacy tools.