Blockchain analytics firm Bitquery estimates that US$102 million was stolen from 324 cryptocurrency wallets in an incident linked to Ledger devices sold through Malaysian reseller CryptoBilis.
The findings, updated on 12 October, increase the estimated losses from the previously reported US$86 million after researchers identified additional transactions.
According to the report, approximately US$79.3 million was taken from wallets on Tron and US$16.8 million from Bitcoin, with the remaining losses spread across Ethereum, BNB Chain, Polygon and Solana.
Signs of Coordinated Activity Across Hundreds of Wallets
Bitquery’s analysis suggests that a single actor may have had access to the keys needed to move funds from the affected wallets.
It found that 25 Tron wallets recorded approvals for the same address within three seconds, followed by withdrawals totalling US$29 million.
Another 30 wallets had their permissions changed before approximately US$5.8 million was withdrawn.
The firm also identified 41 small transaction sequences across Tron and Ethereum in the preceding two weeks, which it interpreted as tests of the withdrawal process.
However, the blockchain records do not establish how the keys were obtained.
Ledger previously confirmed finding an unauthorised hardware implant in one affected device but has not established whether others were compromised in the same way.
The company said all cases it had verified from the 9 October incident involved devices sold through CryptoBilis.
It maintained that its internal systems and direct sales channels remained unaffected.
US$10 Million Frozen as Funds Move Across Networks
Bitquery reported that Tether had frozen US$10 million in USDT across 20 wallets linked to the incident.
It also traced funds through cryptocurrency swapping services and privacy tools, including Tornado Cash and Zcash.
By 12 October, approximately 6,680 ETH had been sent through Tornado Cash, while Bitquery estimated that around US$82 million of the suspected stolen funds remained traceable on-chain.
The firm also identified two wallets holding 2.38 million USDC that it believes may be linked to the suspected attacker. According to Bitquery, Circle could potentially freeze those funds.
The investigation found that some affected wallets first received funds before Ledger’s initial 90-day warning period, although this does not establish when the associated devices were purchased.
Ledger has advised CryptoBilis customers not to activate unused devices and to move assets from existing wallets to a new device with a newly generated recovery phrase.
According to Bitquery, CryptoBilis has stopped selling hardware wallets while the investigation continues.
The US$102 million figure remains Bitquery’s independent estimate and has not been confirmed by Ledger.
Featured image: Edited by Fintech News Malaysia, based on image by shyachlo via Magnific
