Reports circulating across the crypto community describe a Ledger-related wallet drain totaling a reported $92.9 million, with losses spread across the Bitcoin, Ethereum, and TRON networks. As first detailed in a report by U.Today, the incident has raised urgent questions about how the wallets were compromised and what affected users should do next.

The $92.9 million figure represents an aggregate across three separate blockchain networks: Bitcoin, Ethereum, and TRON. At this stage, no chain-by-chain breakdown has been verified, meaning the total should be treated as a reported estimate rather than a confirmed figure.

What "Ledger-related" actually means

The phrase "Ledger-related" does not automatically mean that Ledger's hardware devices were directly exploited. It indicates that the incident has some connection to Ledger — whether through software, services, or users of Ledger products. This distinction matters: two recent wallet incidents show how crypto users can be targeted without any hardware wallet being hacked, often through phishing or compromised software components instead.

Ledger is a company that manufactures hardware wallets — physical devices used to store cryptocurrency offline. When reports describe an incident as "Ledger-related," it can refer to a breach of Ledger's own software or services, a supply chain compromise, or a campaign that specifically targets Ledger users through deception.

A past example illustrates why this distinction is important. Investigators previously traced an $86 million theft to a fake Ledger website designed to steal wallet recovery phrases — not to any flaw in the hardware itself. Users were tricked into entering their seed phrases, giving attackers full access to their funds.

Ledger has published a security incident report on its official blog. That page should be treated as the primary reference for confirmed details as the situation develops. Unverified claims circulating on social media should not be acted upon until official guidance is available.

Why Bitcoin, Ethereum, and TRON are each a separate concern

The three named networks operate independently. Bitcoin transactions settle on the Bitcoin blockchain, while Ethereum and TRON each maintain their own separate ledgers and smart contract systems. A drain spanning all three networks suggests either a common point of failure — such as a shared software library or user interface — or a coordinated attack campaign targeting users across chains.

Without transaction hashes or on-chain evidence linking the three networks to a single exploit, the cross-chain scope cannot be independently verified. Blockchain explorers for each network, such as Mempool.space for Bitcoin, Etherscan for Ethereum, and Tronscan for TRON, allow anyone to trace wallet activity directly. Until specific addresses or transaction IDs are published by Ledger or security researchers, the three-network framing remains a reported claim.

Large-scale wallet compromises are not unusual. A single Malaysian holder recently reported losing $3.05 million in a suspected wallet hack, illustrating how individual incidents can add up quickly when attackers target many users at once. Security tools can also be weaponized at scale, as seen when Kaspersky exposed OkoBot's 20-module crypto wallet attack targeting multiple chains simultaneously.

What to check — and what to avoid — right now

For users of a Ledger device, or any wallet connected to Ledger's software, the immediate priority is to check official channels. Visit Ledger's security incident blog directly rather than relying on links shared through social media or email, as phishing attacks often follow major security news.

Do not approve unexpected transaction requests. Do not share your seed phrase or private key with anyone, including anyone claiming to be Ledger support — Ledger will never ask for your seed phrase under any circumstances.

The key open questions remain unanswered: which specific wallets were affected, what transaction data supports the $92.9 million total, what the root cause was, and whether any recovery is possible. Until official sources answer these questions with verifiable on-chain evidence, the reported scope should be treated as un.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and asset markets carry significant risk. Always do your own research before making decisions.