Ethena founder and CEO Guy Young said that the large on-chain transfers carried out by a major investor over the past 48 hours were a defensive move tied to the recent Ledger hardware wallet scare, and not a sign that the holder is dumping tokens.

Young made the remarks in a post on X after ENA holders who had spotted the activity feared that a whale was heading for the exit.

What Young said

In the X post, Young confirmed that the moves were “a security precaution related to the recent hardware wallet concerns, not coins being moved and sold.”

Users had raised alarms about a major wallet relocating tokens. When news of this kind circulates, users often assume that a security breach or a coordinated dump is underway, and the resulting reactions could cause the token itself to crash. Young stepped in to calm nerves, saying the transfers were preventive and that the investor was not selling.

Ethena has drawn scrutiny before over large holders shifting tokens to exchanges.

The hardware wallet scare behind the move

The concerns Young referenced in his post are linked to the ongoing investigation that Ledger opened on October 9 into drained funds from its devices sold by CryptoBilis, a reseller based in Southeast Asia. Ledger later said the cause was a covert chip hidden inside some CryptoBilis-sold units.

The implant read a user's 24-word recovery phrase off the device screen during setup and transmitted it to an attacker over an LTE mobile network using an eSIM. The attack is being described as a physical supply-chain attack — a class of breach in which tampering enters through the distribution chain rather than a vendor's own systems. Ledger said that it has no indication that its infrastructure, systems, services or direct sales channel has been compromised.

Cryptopolitan reported that on-chain researchers pegged losses at between $84.2 million and $93.2 million across more than 300 wallets, with Tether freezing $10 million in USDT tied to the thefts. Ledger has not confirmed a victim count or a dollar total.

The fallout from the incident spread across the industry. Fellow hardware wallet provider Trezor is cutting its authorized reseller network and has informed partners that their status ends by January 1, 2027. Trezor said that it found no evidence that its own devices were compromised. CryptoBilis halted sales of all the brands it carried, and MediaMarkt Saturn, a Ledger hardware reseller in Germany, has stopped selling the devices as a precaution following the supply-chain breach.

Why an investor would reshuffle holdings now

Ledger urged its users to move their coins to a fresh signer. The company also advised anyone who bought a hardware wallet from CryptoBilis within the past 90 days to leave unused devices untouched, and told those already using the devices to transfer assets to a new device with a newly generated recovery phrase.

That advice lines up with what Young described as the investor's actions. Rotating to a fresh signer means moving funds into new addresses, and because those movements are publicly visible on-chain, a precaution can look like a liquidation before the intent behind it is known. The transfers were a case of rotating funds for safety rather than liquidation, according to the CEO. No other information challenging Young's statement has emerged so far, meaning users will have to take his word for it and watch the investor's on-chain movements in the coming days — along with any updates from Ledger's still-open investigation.

Ethena did not name the investor or disclose the size of the transfers. The company runs the synthetic dollar protocol behind USDe, with ENA serving as its associated token.