The on-chain tally of crypto taken from Ledger devices sold by reseller CryptoBilis has moved higher, and phishing emails are now using the panic to ask people for recovery phrases. CoinDesk reported on 12 October that Bitquery had traced $93.2 million from 315 wallets across six chains, and that Tether had frozen $10 million in USDT. A later Bitquery count, reported on 18 October, put the traced total at $102 million from 335 wallets as of 16 October. Ledger has not confirmed either figure. The company has said confirmed cases involve devices sold by CryptoBilis, and that at least one device carried an unauthorised hardware implant that copied recovery words during setup.
Tether's $10 million freeze does not repay victims
The later tracing said Tether blocked 37 addresses tied to the theft, with the $10 million of USDT sitting across 20 of them. A freeze stops those tokens moving. It does not send them back to the people who lost them. Investigators said funds also moved through THORChain and Tornado Cash, and that about $23.9 million of USDD was swapped into ether. USDD is not a Tether token, so that slice cannot be frozen the same way. Our earlier report, Tether freezes $10 million, used the $93.2 million figure. The gap between $93 million and $102 million is additional wallets and transfers identified after that story, not a second incident. Anyone who bought a device from CryptoBilis should not set up an unused unit. Anyone already using one should move assets to a new device with a newly generated recovery phrase, which is the step Ledger has asked customers to take.
Fake firmware emails are the second wave
On 16 October, blockchain security firm SlowMist flagged emails telling recipients to connect a hardware wallet and install a firmware update "to protect your device against emerging spyware threats, such as recent incidents in Malaysia." The messages use a fake genuine-check page, a device picker and an "Update Now" button. Protos reported the campaign. Ledger updates do not arrive as a link in an email, and Ledger will not ask for a recovery phrase. Type the official address yourself, or use the updater inside Ledger Live that you already installed. Do not enter a recovery phrase on a website. Chainalysis, cited in the same report, said one of the larger victims of the original drain was itself a task-scam operator that lost more than 60 BTC, about $4.8 million. That does not shrink the loss for ordinary customers. For what a real tracing firm does, and what a fake recovery shop asks for, see our wallet security guide and how crypto recovery works.