CryptoBilis Ledger Hack: $95M Stolen, $10M Frozen
Arkham Intelligence says the CryptoBilis Ledger drainer stole $95.35 million from 1,486 addresses between October 7 and 9. Most of the funds—$80.60 million—were taken in 51 minutes on October 9. The attacker has moved $13.84 million in the past 48 hours, while at least $69.19 million has passed through swaps and cross-chain bridges. Arkham traced 9,529 ETH, worth $23.27 million, to Tornado Cash deposits. It identified $30.44 million in remaining tagged holdings, including $10 million in USDT frozen by Tether. Ledger previously said confirmed thefts involved devices bought through Southeast Asian reseller CryptoBilis, where an unauthorized implant could capture recovery phrases. Ledger has not independently confirmed the total losses or affected customer count. The incident may weigh on confidence in hardware-wallet security, although its direct effect on broader crypto markets appears limited.
Bearish
The CryptoBilis Ledger hack is a negative security signal for hardware wallets and may trigger short-term risk aversion among affected users and traders. The reported $95.35 million loss, continued movement of stolen funds and use of Tornado Cash could renew concerns about wallet safety, illicit transfers and the difficulty of recovering assets. Similar exchange and wallet breaches have often caused sharp, short-lived selling in assets directly connected to the incident, alongside increased volatility and withdrawals from platforms perceived as vulnerable.
However, this incident does not indicate a compromise of Ledger’s internal systems or a failure of any major blockchain protocol. The stolen value is small relative to the overall crypto market, and the $10 million USDT freeze demonstrates that some assets can be contained. As a result, broader market effects are likely to be limited unless further losses, new affected devices or evidence of a wider supply-chain breach emerge. In the short term, sentiment around hardware-wallet providers and related services could weaken. Over the longer term, the effect will depend on investigation findings, customer remediation and stronger reseller and device-security controls; it is not, by itself, evidence of a sustained market-wide downturn.