{"id":79307,"date":"2026-10-10T00:55:32","date_gmt":"2026-10-10T00:55:32","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/ledger-wallet-mystery-deepens-as-suspected-losses-hit-93-4m\/"},"modified":"2026-10-10T00:55:32","modified_gmt":"2026-10-10T00:55:32","slug":"ledger-wallet-mystery-deepens-as-suspected-losses-hit-93-4m","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/ledger-wallet-mystery-deepens-as-suspected-losses-hit-93-4m\/","title":{"rendered":"Ledger Wallet Mystery Deepens as Suspected Losses Hit $93.4M"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Ledger\u2019s suspected losses may have hit $93.4 million across 471 addresses, according to Yfarmx.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Chainalysis is tracking a complex laundering operation tied to reports of nearly $100 million in losses.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">With Ledger still investigating on Oct. 9, questions remain about a possible supply chain attack.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Onchain Investigation Points to $93.4 Million in Suspected Losses<\/h2>\n<p>According to <a href=\"https:\/\/yfarmx.com\/ledger-reseller-cryptobilis-drain\/\" target=\"_blank\" rel=\"noopener noreferrer\">an extensive deep dive<\/a> and onchain analysis by Yfarmx reporter John Kamal, suspected Ledger-related losses may have reached $93.4 million across 471 distinct addresses. However, Ledger has yet to verify the findings or confirm the nearly $100 million in alleged losses.<\/p>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/ledger-investigating-86m-drained-crypto-hardware-wallets\/\">Bitcoin.com News reported<\/a> earlier that Ledger was investigating the reports of losses from \u201cusers in South East Asia who purchased products from a reseller named CryptoBillis.\u201d Since then, the company has offered no further findings, leaving independent investigators and onchain sleuths to piece together what may have happened.<\/p>\n<p>Blockchain intelligence firm Chainalysis <a href=\"https:\/\/x.com\/chainalysis\/status\/2108602434729734277?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">acknowledged the situation<\/a> on X, stating that it is \u201cinvestigating reports of funds stolen from holders of Ledger products.\u201d The firm further disclosed that its analysts had identified a \u201csophisticated cross-chain laundering operation.\u201d<\/p>\n<p>Bitquery also investigated the matter and its numbers were very close to Kamal\u2019s analysis. The blockchain data infrastructure and intelligence company\u2019s report puts the number at around $92.9 million across 311 unique addresses. \u201cOne thief had all the keys,\u201d <a href=\"https:\/\/bitquery.io\/investigations\/ledger-cryptobilis-hack\" target=\"_blank\" rel=\"noopener noreferrer\">Bitquery\u2019s analysis explains<\/a>.<\/p>\n<h2>Hidden Hardware Discovery Raises Supply Chain Attack Suspicions<\/h2>\n<p>Alongside this, <a href=\"https:\/\/news.bitcoin.com\/former-mt-gox-ceo-mark-karpeles-to-launch-new-crypto-exchange-with-a-focus-on-transparency\/\">former Mt Gox CEO Mark Karpel\u00e8s<\/a> has <a href=\"https:\/\/x.com\/MagicalTux\/status\/2108576506704548179\" target=\"_blank\" rel=\"noopener noreferrer\">documented Ledger devices<\/a> containing hidden surveillance hardware capable of capturing recovery phrases during setup. Karpel\u00e8s\u2019 discovery suggests that wallets purchased from third-party vendors may have been compromised before users even unboxed the devices and transferred their crypto assets into them.<\/p>\n<figure id=\"attachment_854842\" aria-describedby=\"caption-attachment-854842\" style=\"width:1378px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-854842\" class=\"wp-caption-text\">While hardware investigators have documented a plausible method for stealing recovery phrases from modified devices, definitive evidence remains elusive. Investigators and Ledger have yet to establish whether affected customers received compromised hardware or whether those devices transmitted their recovery phrases.<\/figcaption><\/figure>\n<p>However, despite the theory gaining traction, neither Ledger nor independent investigators have established a definitive connection between these suspected implants and Friday\u2019s reported losses.<\/p>\n<h2>Wallet Drains and Cross-Chain Transfers Deepen the Mystery<\/h2>\n<p>Kamal\u2019s report in Yfarmx indicates that the recorded transfers appeared to have been authorized using the victims\u2019 own signing credentials, while on Bitcoin, certain addresses were drained entirely, with no change UTXOs returned to the original wallets.<\/p>\n<figure id=\"attachment_854848\" aria-describedby=\"caption-attachment-854848\" style=\"width:2560px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-854848 size-full\" src=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-09-at-7-55-40-pm-scaled.png\" alt=\"\" width=\"2560\" height=\"501\" srcset=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-09-at-7-55-40-pm-300x59.png 300w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-09-at-7-55-40-pm-1024x200.png 1024w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-09-at-7-55-40-pm-768x150.png 768w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-09-at-7-55-40-pm-1536x300.png 1536w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-09-at-7-55-40-pm-2048x401.png 2048w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-09-at-7-55-40-pm-scaled.png 2560w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\"\/><figcaption id=\"caption-attachment-854848\" class=\"wp-caption-text\">The Yfarmx report notes that at least seven blockchains were used, including Tron, Bitcoin, Ethereum, BNB Chain, Polygon, Base, and Arbitrum.<\/figcaption><\/figure>\n<p>Several blockchain networks were used alongside <a href=\"https:\/\/news.bitcoin.com\/featured\/thorchain-co-founder-neutral-networks-cant-pick-who-can-transact\/\">applications like Thorchain<\/a> and Tornado Cash. Presently, the consensus is that this was likely a supply chain attack that managed to get a subset of Ledger machines. It doesn\u2019t seem to be anything like the <a href=\"https:\/\/news.bitcoin.com\/security\/coldcard-hack-116-million-fourth-wave\/\">Coldcard firmware bug<\/a>, and nothing points to a remote zero-day.<\/p>\n<p>As stated, Ledger has not confirmed the loss totals. Nor has the company bolstered any of the theories making their rounds on social media. The developments also come on the heels of recent <a href=\"https:\/\/news.bitcoin.com\/security\/trezor-data-leak-spirals-as-67000-more-us-buyers-get-exposed\/\">data breaches involving Trezor<\/a> and Safepal, which exposed the order information of tens of thousands of customers. Kamal\u2019s analysis of the situation further notes that CryptoBillis sold \u201cTrezor, Safepal, Tangem, [and] Onekey\u201d hardware wallets, among others.<\/p>\n<p>For now, the crypto community awaits a formal postmortem from Ledger, hoping the company can shed light on the circumstances behind this perplexing episode and provide some much-needed answers.<\/p>\n<div class=\"not-prose my-3 lg:my-4\">\n<div class=\"overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] hidden md:flex md:flex-row md:gap-3 lg:hidden\"><a aria-hidden=\"true\" tabindex=\"-1\" class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\" href=\"https:\/\/news.bitcoin.com\/data-breach-hits-39798-safepal-customers-after-order-plugin-flaw\/\"><img alt=\"Data Breach Hits 39,798 Safepal Customers After Order Plugin Flaw\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"object-cover\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent\" sizes=\"150px\" srcset=\"\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=32&amp;q=75 32w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=48&amp;q=75 48w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=64&amp;q=75 64w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=128&amp;q=75 128w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=256&amp;q=75 256w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=384&amp;q=75 384w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=640&amp;q=75 640w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=828&amp;q=75 828w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=1080&amp;q=75 1080w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=1200&amp;q=75 1200w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=1920&amp;q=75 1920w\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=1920&amp;q=75\"\/><\/p>\n<div class=\"absolute left-2 top-2\"><img alt=\"Bitcoin.com News\" loading=\"lazy\" width=\"28\" height=\"28\" decoding=\"async\" data-nimg=\"1\" class=\"size-7\" style=\"color:transparent\" srcset=\"\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=32&amp;q=75 1x, \/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75 2x\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75\"\/><\/div>\n<p><\/a><\/div>\n<div class=\"overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] hidden lg:flex lg:flex-row lg:gap-4\"><a aria-hidden=\"true\" tabindex=\"-1\" class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\" href=\"https:\/\/news.bitcoin.com\/data-breach-hits-39798-safepal-customers-after-order-plugin-flaw\/\"><img alt=\"Data Breach Hits 39,798 Safepal Customers After Order Plugin Flaw\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"object-cover\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent\" sizes=\"150px\" srcset=\"\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=32&amp;q=75 32w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=48&amp;q=75 48w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=64&amp;q=75 64w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=128&amp;q=75 128w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=256&amp;q=75 256w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=384&amp;q=75 384w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=640&amp;q=75 640w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=828&amp;q=75 828w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=1080&amp;q=75 1080w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=1200&amp;q=75 1200w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=1920&amp;q=75 1920w\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fsafepal-announcement-150x150.jpg&amp;w=1920&amp;q=75\"\/><\/p>\n<div class=\"absolute left-2 top-2\"><img alt=\"Bitcoin.com News\" loading=\"lazy\" width=\"28\" height=\"28\" decoding=\"async\" data-nimg=\"1\" class=\"size-7\" style=\"color:transparent\" srcset=\"\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=32&amp;q=75 1x, \/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75 2x\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75\"\/><\/div>\n<p><\/a><\/p>\n<div class=\"flex min-w-0 flex-1 flex-col justify-center gap-2\">\n<p class=\"m-0 line-clamp-2 text-base leading-[1.3] !text-[#67656E]\">The hardware wallet manufacturer stressed that unauthorized threat actors gained access to the data through a malfunctioning plugin used to\u2026<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/ledger-wallet-mystery-deepens-as-suspected-losses-hit-93-4m\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Ledger\u2019s suspected losses may have hit $93.4 million across 471 addresses, according to Yfarmx. Chainalysis is tracking a complex laundering operation tied to reports of nearly $100 million in losses. With Ledger still investigating on Oct. 9, questions remain about a possible supply chain attack. Onchain [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":79308,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/79307"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=79307"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/79307\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/79308"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=79307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=79307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=79307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}