Hacker Transfers Another $13.84 Million Stolen via Ledger Wallets from CryptoBilis

The drainer associated with the Southeast Asian reseller CryptoBilis and manufacturer Ledger continued to move stolen cryptocurrency: in the last 48 hours, it transferred $13.84 million. Previously, Arkham Intelligence traced thefts amounting to $95.35 million, affecting 1,486 addresses.

According to Arkham, the thefts occurred from October 7 to 9, with the main part happening on October 9 within 51 minutes, starting at 05:07:48 UTC. During this time, the attacker collected $80.60 million, including $58.19 million in USDT through 335 transfers on Tron. At the same time, 112 Bitcoin addresses transferred 203.26 BTC worth $16.73 million in one block at 05:54 UTC.

At least $69.19 million went through swaps and bridges between networks. Tornado Cash received 9,529 ETH worth $23.27 million through 559 transactions. Addresses associated with the attacker still hold $30.44 million, including $10 million USDT frozen by Tether.

On October 13, Ledger confirmed an unauthorized hardware implant capable of capturing recovery phrases during setup. All confirmed thefts investigated by the company involved devices purchased through CryptoBilis; how the components ended up in the devices has not been established. Ledger has tightened requirements for resellers and suspended authorized sales in several Southeast Asian countries.

On October 28, Singapore police reported two cases with losses of about SGD 3.5 million: preliminarily, malicious components might have captured recovery phrases or private keys. On October 16, Bitquery estimated the theft at $102 million from 335 wallets across six networks. Ledger has independently not confirmed either the total amount or the number of victims.