Suspected thefts tied to Ledger hardware wallets are approaching $90 million, and stablecoin issuer Tether has begun freezing USDT linked to the incident, according to blockchain investigators.

In an Oct. 9 statement, the crypto hardware wallet maker said it was investigating reports that customers lost funds after purchasing devices from CryptoBilis, an authorized reseller operating in Southeast Asia. As a precaution, Ledger asked the distributor to immediately pause sales and shipments of its hardware wallets while the investigation continues.

Guidance for affected customers

Ledger advised customers who bought devices from CryptoBilis within the past 90 days not to initialize them if setup had not yet been completed. Those who had already configured their wallets were urged to consider transferring their cryptocurrency to a new Ledger device initialized with a fresh recovery phrase.

CryptoBilis appears in Ledger's official reseller directory for Malaysia, Indonesia, and the Philippines. Customers buying through authorized distribution channels generally rely on those relationships to reduce the risk of receiving counterfeit or compromised hardware. Hardware wallets occupy a distinctive place in that trust model, since users buy them to keep private keys offline; a compromise introduced anywhere along the distribution chain would undercut the very protection the purchase is meant to provide.

Industry figures respond

The incident drew attention from Binance founder Changpeng Zhao, who warned users to exercise caution, particularly if they had recently purchased a Ledger device.

"Based on information so far, it seems to be localized to a supply chain attack with one vendor," he wrote on X.

Zhao suggested that a limited number of customers may have received counterfeit or tampered devices, while emphasizing Ledger's longstanding security reputation. He also called for cooperation across the cryptocurrency industry to identify the suspected attackers and recover the stolen assets.

"I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds," he added.

Meanwhile, former Mt. Gox CEO Mark Karpelès is investigating whether malicious hardware components were inserted into devices distributed to customers. Karpelès asked CryptoBilis to open some of its unsold Ledger wallets so their internal circuit boards could be inspected for possible spying implants or other unauthorized modifications.

Authentication limitations in focus

The concern highlights a limitation in Ledger's hardware authentication process. The company's security documentation acknowledges that its Genuine Check system verifies a device's Secure Element but cannot necessarily identify physical modifications elsewhere in the hardware if the original security chip remains intact. That means a physically altered device could pass authentication even if it contains unauthorized components. For customers, that limitation is significant: the Genuine Check is the verification available to them when setting up a new device, and passing it does not rule out tampering elsewhere in the hardware.

No confirmed evidence shows that malicious hardware implants caused the reported thefts. Ledger has not disclosed how many devices may have been compromised, nor has it established whether the incident resulted from counterfeit hardware, physical tampering, or another attack method.

Investigators race to contain losses

While Ledger examines the suspected source of the compromises, blockchain investigators are working to trace and restrict the movement of stolen cryptocurrency.

On-chain investigator Specter said transaction analysis identified inflows from hundreds of suspected victim wallets into addresses across Bitcoin, Ethereum, and Tron. Specter initially estimated the suspected thefts exceeded $86 million, but blockchain security firm MistTrack later placed the reported losses closer to $90 million.

Those estimates have not been independently verified, and investigators have not established whether every wallet included in the calculations was compromised through the same operation.

MistTrack said it observed Tether freezing USDT linked to the incident and that several affected users contacted its team for help.

What freezing can and cannot do

The freezing offers a potential recovery avenue because USDT includes administrative controls that allow Tether to restrict transfers from designated addresses. Once an address is frozen, users cannot move the affected USDT through ordinary blockchain transactions unless the restriction is lifted. That capability can help prevent stolen funds from moving to additional wallets or being converted into other cryptocurrencies while investigators work to establish ownership.

The intervention has limits, however. The suspected thefts span several blockchain networks and involve assets beyond USDT. Tether cannot directly native Bitcoin or Ethereum, leaving investigators dependent on cooperation from exchanges, custodians, and law enforcement if those assets move into identifiable services.

Freezing USDT also does not automatically return tokens to their original owners. Any restitution would require further verification and coordination with the relevant authorities or counterparties.

MistTrack has not disclosed the dollar value of the restricted tokens, making it impossible to determine what proportion of the nearly $90 million in reported losses could ultimately be recovered. That uncertainty puts added pressure on investigators to identify where the remaining funds went before they are dispersed through further transactions. Until the value of the frozen tokens, the findings of Ledger's investigation, and the results of the device inspections are disclosed, the eventual scale of the recovery will remain unclear.