Ledger has identified an unauthorized hardware implant in one device examined after the CryptoBilis reseller compromise, providing the first confirmed physical cause for at least one victim’s loss. The finding materially advances the incident, but it does not establish that every affected wallet was compromised in the same way.
Bitquery’s updated investigation, timestamped October 11 at 07:00 UTC, traces approximately $93.2 million from 315 wallets across six networks. The largest component was $70.5 million on TRON, followed by $16.8 million in Bitcoin, $3.7 million on Ethereum, $1.45 million on BNB Chain, $580,000 on Polygon and $250,000 on Solana.
The 315 figure refers to wallets, not confirmed individual victims. Investigators observed small test transactions over roughly two weeks before the larger withdrawals. Approvals occurring at nearly the same time across different chains are consistent with an attacker possessing keys, but the public evidence does not yet explain how every key was obtained.
Tether froze approximately $10 million in USDT. Bitquery reports that about 2,990 ETH moved through Tornado Cash and Zcash, while roughly 5.35 million USDC remained distributed across five wallets at the time of the update. Approximately $81 million was still located onchain, although location does not guarantee recovery.
Attribution beyond the directly observed transactions remains qualified. Links reconstructed after assets enter privacy tools or mixers can be strong investigative leads without proving that every downstream address belongs to the original attacker.
TOKEN RECON ASSESSMENT
The implant turns a suspected supply-chain vector into a confirmed mechanism for one device. The unresolved risk is scale. Ledger and investigators still need to determine whether the modified unit was an isolated artifact, part of a repeatable reseller process or only one technique inside a wider campaign. Recovery now depends on rapid freezes, exchange cooperation and whether the remaining funds move into identifiable services before further obfuscation.
Source
Bitquery: Ledger CryptoBilis hack investigation and October 11 update
