A trader’s 80 bitcoin, worth about $6.6 million at the time, was moved in a single transaction on October 9, just 10 days after the funds were transferred to a newly purchased Ledger hardware wallet. Ledger has asked Southeast Asian reseller CryptoBilis to suspend sales while it investigates. It has not been confirmed whether the device was tampered with.
The incident has drawn attention to hardware-wallet sourcing and setup, as well as the loss of a large bitcoin holding. Ledger has not released its findings, and blockchain firms have offered differing estimates of the total funds involved.
80 BTC moved in a single transaction on October 9
Blockchain tracker Lookonchain said the trader bought the 80 bitcoin about four months earlier at an average price of roughly $65,000 per coin, for a total cost of about $5.2 million. Public blockchain records show the funds entered the wallet on September 29 and were transferred out in one transaction at 05:54 UTC on October 9.
Bitcoin was trading above $83,000 at the time of the transfer. Based on that price, Lookonchain estimated the holding had an unrealized gain of about $1.38 million before it was moved. The same batch of transactions included at least six other large transfers to addresses analysts believe are linked to the incident. Those links remain based on blockchain analysis.
Ledger asks CryptoBilis to halt sales
Hours after the transfer, Ledger asked CryptoBilis to stop selling the device and advised customers who had recently bought one not to set it up for now. Ledger has not said whether any devices were altered during sale or delivery, and has not identified the model involved or published its investigation findings.
Hardware wallets are generally used to store crypto assets offline, but the cause of this incident remains unknown. Available information does not establish whether the transfer was connected to the wallet itself, the sales channel, the device’s initial setup or another factor. Ledger says it will provide an update as its investigation progresses.
Estimates of related losses top $80 million
Blockchain analytics firm Arkham estimated that losses linked to the incident exceeded $80 million, while noting that the cause had not been confirmed. MistTrack, a tracking service operated by security firm SlowMist, put the potential total higher, at as much as $90 million.
MistTrack also said that Tether, the issuer of the USDT stablecoin, had frozen USDT held at addresses linked to the theft. Tether can restrict transfers of tokens it issues. The action applies to USDT at those addresses and does not mean the bitcoin itself has been frozen.
Hardware-wallet security concerns resurface
Hardware-wallet makers have faced renewed scrutiny after several security issues this year. In August, a vulnerability in Coldcard firmware was reported to have enabled attackers to move about $70 million in bitcoin.
Ledger’s investigation is ongoing. Key questions include whether the device was tampered with, whether there were problems in the reseller’s sales or delivery process, and how much of the funds identified through blockchain analysis can be linked to the case.