A reported wallet drain connected to Ledger, one of the most widely used hardware wallet makers in crypto, has drawn attention across the cryptocurrency security community, with a figure of $92.9 million cited across Bitcoin, Ethereum, and TRON. The cross-chain scope of the reported drain distinguishes it from single-network incidents and raises questions about self-custody exposure for users who hold assets across multiple chains simultaneously.

What the reported incident covers

According to reporting by U.Today, the incident is described as a Ledger-related exploit totaling $92.9 million across wallets on Bitcoin, Ethereum, and TRON. The exact attack vector, the number of affected wallets, and the timeline of the drain have not been independently verified at the time of writing, and the figures should be treated as reported rather than confirmed.

The Ledger-related framing matters for DeFi users in particular. Ledger, a France-based hardware wallet maker whose devices are designed to keep private keys offline, is widely used for cold storage of assets that are also actively deployed in on-chain protocols, including lending markets, liquidity pools, and restaking vaults. Unlike balances held on a centralized exchange, assets secured by a hardware wallet sit directly under the holder's control, with no intermediary to absorb losses or pause withdrawals if the signing layer is compromised. A hardware wallet compromise does not require an on-chain exploit of a protocol; it can bypass smart contract security entirely by compromising the signing layer.

Why cross-chain scope changes the risk calculus

Drains confined to a single chain allow investigators to trace flows through a single block explorer. A three-chain event spanning Bitcoin, Ethereum, and TRON complicates both attribution and recovery. Bitcoin transactions are irreversible and pseudonymous; Ethereum addresses can be flagged by on-chain security tools via Etherscan; and TRON operates its own network with distinct explorer infrastructure, making cross-chain correlation non-trivial.

For users with liquidity actively deployed on Ethereum, such as positions in Aave or similar lending protocols, a compromised signing device creates a risk surface that extends beyond the hardware wallet itself. Because on-chain positions obey whoever holds the controlling keys, an attacker who controls signing can withdraw collateral, close existing positions, or redirect yield-bearing tokens without triggering any on-chain anomaly detection tied to the smart contract layer.

This is not the first cross-chain incident to expose the limits of hardware-level security assumptions. Earlier this month, the HOT Omni Bridge on NEAR was exploited in a separate event that similarly spanned multiple networks, underscoring that cross-chain attack surfaces remain an active vector in the current threat environment.

What users and protocols should monitor

Until Ledger or an independent security firm publishes a full post-mortem, the precise scope of affected devices or firmware versions remains open. Users holding cross-chain assets in hardware wallets should monitor Ledger's official security advisories and verify that their device firmware is current, relying on confirmed updates rather than unverified secondary reports about affected device ranges or firmware versions. Firmware and wallet applications should be obtained only through official channels. As a general precaution, a hardware wallet's recovery phrase — the word sequence used to restore a wallet — should never be entered on any website or shared with anyone, since no legitimate wallet maker or support desk requests it.

Protocol-level controls, such as time-locked withdrawals or guardian multisig overrides on high-value positions, offer a secondary defense layer that operates independently of the signing device.

On-chain investigators tracing the reported drain should cross-reference Bitcoin mempool data, address monitoring tools on Ethereum, and TRON's block explorer to correlate outflows by timestamp and address clustering across the three networks. Without confirmed transaction hashes from a verified source, publishing specific on-chain attribution would inaccuracy. Developments worth watching include whether Ledger confirms or disputes the reported figure, whether a post-mortem identifies a specific attack vector, and whether independent security firms flag the receiving addresses across the three chains.