Bitquery estimates Ledger reseller-linked wallet drain at $102 million
Blockchain analytics firm Bitquery estimated that a wallet-draining incident linked to Southeast Asian reseller CryptoBilis totaled $102 million across 324 wallets on six blockchains, while Ledger stated that its direct sales channels and internal systems remain unaffected.
A wallet-draining incident tied to hardware sold by Southeast Asian reseller CryptoBilis resulted in the theft of $102 million from 324 wallets across six blockchains, according to a Bitquery investigation authored by Gaurav Agarwal and verified on October 12, 2026. Bitquery noted that the draining began on October 9, 2026, targeting users who acquired Ledger devices through the reseller, concluding that a single thief held all the private keys.[1]
On-chain activity tracked following the exploit shows that Tether froze $10 million of the stolen assets, while 6,680 native ether was transferred into Tornado Cash. Another $2.4 million in USD Coin remains located in an address where issuer Circle could potentially freeze the balance. The distributor had been listed on Ledger's authorized reseller registry at the time of the purchases.[1]
Hardware manufacturer Ledger confirmed that all verified cases from the October 9 incident exclusively involve devices distributed by CryptoBilis, according to an update shared by Scott Melker. Ledger emphasized that its internal infrastructure and direct sales channels were not compromised.[4]
Individual victim losses have surfaced across on-chain tracking platforms. Lookonchain documented that an investor who held assets securely in an untouched wallet for eight years migrated funds to a new address a month earlier, only to lose 59 ETH, valued at approximately $146,800, to an address labeled CryptoBillis Ledger Drainer.[2][3][5]
Key facts
- Bitquery raised its loss estimate for the CryptoBilis-linked Ledger drain to $102 million taken from 324 wallets across six blockchains.
- Bitquery's report, verified on October 12, 2026, stated that the theft began on October 9, 2026, and that one perpetrator possessed all private keys.
- Tether froze $10 million of the stolen assets, while 6,680 native ETH was deposited into Tornado Cash and $2.4 million in USDC remains sitting in an unfrozen wallet.
- Ledger stated that all confirmed cases involve devices supplied by Southeast Asian distributor CryptoBilis, and that Ledger's systems and direct sales channels remain unaffected.
- Lookonchain reported that a user lost 59 ETH (~$146,800) to the CryptoBillis Ledger Drainer roughly one month after moving funds out of an eight-year-old wallet.
Sources · 4 sources
- KO
kook@KookCapitalLLCPost on X ·
bitquery just raised the ledger reseller drain to $102m tether froze $10m and the rest is still walking..... 324 wallets emptied across six chains 6,680 ethereum:native already dumped into tornado cash $2.4m $USDC still sitting where circle can freeze it ct spent the day arguing if this is a cryptobilis problem or a ledger problem the reseller was on ledgers authorized list the whole time your cold wallet is only cold if nobody else printed the seed who is eating this loss????
Open source - LO
Lookonchain@lookonchainPost on X ·
Another unlucky guy! His old wallet had been safe for 8 years. But a month ago, after more than 4 years of inactivity, he switched to a new wallet. Then the #CryptoBillis #Ledger Drainer stole all 59 $ETH ($146.8K) from it. https://t.co/hsAgRhQFXr https://t.co/1782eJG5sc
Open source - KO
kook@KookCapitalLLCPost on X ·
wallet sat safe for 8 years, guy finally "upgrades his security" and gets drained for 59 ethereum:native in a month https://t.co/AQ1FwJGAH5
Open source - TW
The Wolf Of All Streets@scottmelkerPost on X ·
UPDATE: LEDGER SAYS ALL CONFIRMED CASES OF THE OCT. 9, 2026 DRAINING INCIDENT INVOLVE DEVICES SOLD THROUGH SOUTHEAST ASIA RESELLER CRYPTOBILIS SYSTEMS AND DIRECT SALES CHANNELS REMAIN UNAFFECTED
Open source - CR
Crypto Rover@cryptoroverPost on X ·
This is absolutely heartbreaking. He held through the 2018 bear market, the COVID crash, the China mining ban, the LUNA collapse, Celsius, FTX, the 10/10 crash, and countless corrections. His wallet stayed safe for 8 years. A month ago, he switched to a new wallet that was reportedly compromised by the CryptoBillis Ledger drainer. All 59 $ETH ($146.8K). Gone.
Open source