Tether has frozen about $10 million linked to the draining of Ledger devices sold by Southeast Asian reseller CryptoBilis, as loss estimates from the hardware implant attack climbed to between $72 million and $93.2 million. Researchers counted 311 to 315 compromised wallets across Bitcoin, Ethereum, BNB Chain, Polygon, Solana and Tron, CryptoBriefing reported, with about $70 million of the total held in USDT on Tron, which gave the issuer's blacklist real bite. Some stolen funds were routed through mixers including Tornado Cash. In its 72-hour update on Sunday, Ledger said every confirmed case from the 9 October incident involves CryptoBilis devices, that its own systems and direct sales channels were not affected, and that the reseller has stopped selling all hardware wallet stock while the investigation runs with authorities and the SEAL 911 response group.
What exposed buyers should do now
The implants are described as small cellular circuit boards hidden behind device screens that captured 24-word recovery phrases and transmitted them, Help Net Security reported. Former Mt. Gox chief Mark Karpeles said he bought a tampered device in Malaysia. Anyone who bought from CryptoBilis and has not set the device up should not start, and users who already did should move funds to a new device with a brand new recovery phrase, since reloading the old phrase keeps using words that may already be exposed. Ledger stressed it will never call, message or ask for a recovery phrase, and warned that scammers are exploiting the incident. Buyers can check the red flags in our report on the fake Ledger sites now targeting victims and the first drains in the CryptoBilis investigation.