Twelve days is a long time in crypto incidents. On October 9 the first victims of the Ledger supply-chain theft watched wallets empty in seconds; by October 21 the case has already produced four pieces of reporting from this desk, an industry reshuffle of retail rules, a new $899 device, and — as of October 19 — a quiet widening of the investigation itself (Bloomberg).
This is the closer. No new breaking fact drives it; what drives it is that the story has settled enough to be accounted for honestly. That means admitting which numbers were wrong and why, reading the 47-minute execution for what it says about the attackers, following the money to where roughly $81M still sits in the open, and listing the questions nobody can currently answer.
The earlier installments, for the record: our first-day on-chain accounting, the reseller acquisition that became the attack surface, the implants reaching European retail, and the task scammer who lost 60 BTC to the same thieves.
How the Ledger hack’s price tag grew from $86M to $102M
The most-quoted correction arc of this incident is a lesson in how loss figures are actually built.
On October 9, victims publicized ten collection addresses, and Specter’s early tally of those addresses read $86.96M. Our own first pass at the same addresses — summing cumulative inflows rather than end-of-day balances — came to about $91.6M (we published both numbers and the method). A second tracker, tanuki42, estimated $72M+. Three tools, three honest answers, because they measured different things: snapshot balances, lifetime inflows, and partially tagged flows.
Bitquery then did what only a full-tracing pass can do: it followed the thief’s consolidation behavior instead of the victims’ publicized addresses. That found drains nobody had listed — including nine TRON wallets emptied of 8.8M USDT at 20:49 UTC on day one, and later 11 more TRON wallets holding mostly TRX — bringing the count to 335 victim wallets across six chains and $102.0M as of its October 16 update. The original $86M wasn’t wrong so much as partial: it counted ten public addresses on three chains and missed Solana, BNB Chain, Polygon, and six unpublicized TRON addresses.
Two qualifications belong on every retelling. First, Ledger has confirmed no total — the company’s stated position is that circulating figures come from third parties. Second, the pool is dirty: Chainalysis showed at least 60 BTC of the total was a task-scam operator’s criminal proceeds, sitting in three implanted wallets when the sweep came. “Stolen from victims” and “stolen from criminals” mix in every headline number, which matters for insurance math and matters double for anyone quoting these figures as savings lost.
One more datapoint from the victim side: six of ten sampled wallets were first funded inside the return window, and eight of ten started funding in June — people who bought devices and loaded them within months of the attack. The wallets weren’t dormant cold storage; they were fresh setups, which is exactly what a seed-phrase-harvesting implant needs.
The 47 minutes: an operation, not a heist
The execution layer is the part no one had covered before Bitquery published its dated timeline, and it deserves a slow read.
The rehearsal ran for nearly two weeks: 41 small test cycles between September 26 and October 7 — 21 on TRON, 20 on Ethereum — moving trivial amounts between the thieves’ own addresses. Then October 9, UTC:
- 03:55 — one wallet receives a second key belonging to the thief. By 09:49 that wallet alone has lost 4M USDT.
- 04:59:57–05:00:00 — thirty wallets have the thief’s key added within three seconds of each other.
- 05:07:48–05:07:54 — twenty-five wallets sign the same approval pattern in bursts; $29.0M is out within roughly seven minutes of the first signature.
- 05:09 — the first Ethereum wallets drain, three of them holding ~300 ETH each.
- 05:54:20 — 111 Bitcoin wallets are emptied inside a single block, about 203 BTC.
- 20:49:21 — hours later, nine TRON wallets go in one block for 8.8M USDT.
That is not exploit behavior. There is no reentrancy, no flash loan, no bug being leveraged — the thieves already held the keys and were executing a prepared runbook against hundreds of accounts, sequenced by chain. The implant itself was equally industrial: Ledger’s security lab Donjon described a microcontroller that reads the 24-word recovery phrase off the screen during setup and exfiltrates it over an embedded eSIM on LTE, leaving the Secure Element untouched and the genuine-check blind. Tear-downs documented three hardware generations, including a production-ready variant with a Nordic LTE module and a custom antenna. Karpelès, who now runs the lab that examined the Changi airport device, put it to Bloomberg plainly: “This is not your guy in a garage putting implants on a Ledger… This is the kind of scale you see in spy movies.”
The device story has a human bookend worth keeping: the Changi unit — the sealed-looking Flex that helped trigger the public warning on October 8 — belonged to Ben Yorke, a Kuala Lumpur crypto worker who bought it at a Metapod shop in Singapore’s airport, never initialized it, noticed pry marks on the back cover, and mailed it to Karpelès, who found the display-tapping connector, cellular chip, and SIM (Bloomberg). The seal was never the guarantee people think it is.
The official second half: new rules, a new device, and a definition under strain
Ledger’s response came in two waves. The operational wave: devices moved from shelves to stockrooms, returns barred from resale, suspicious units flagged upward; MediaMarktSaturn pulled stock from roughly 1,070 stores across 11 European countries; Southeast Asian distributors and Hong Kong were told to halt sales; Trezor and OneKey both shrank their reseller networks, with OneKey offering free replacements to CryptoBilis buyers (full account here).
The product wave: on October 15 in Paris, Ledger announced Atom — $899 (founder edition $849), Android-based, tamper-detectable while powered off, built in its own Vietnam factory, sold only through Ledger’s own site, shipping “summer 2027” pending certification (Gizmodo, CryptoPotato). Read as security architecture, Atom is an admission: the fix for a distribution attack is to own the distribution. Anyone holding the date against them should remember the Stax shipped about a year later than first promised.
The framing to watch, though, is the definitional one. Ledger characterized the incident as “a localized distribution attack” tied to the implicated reseller channel. On October 19, Bloomberg reported the company “is also reviewing reports of implants found in wallets purchased elsewhere — suggesting the problem may extend beyond a single retailer,” and quoted a spokesperson describing a “highly organized criminal group.” Whether “localized” survives that review is now an open question, not a settled fact.
Where the money is: a map with $81M still on it
The defensive plays split cleanly along issuer capability. Tether froze $10.0M in USDT across linked wallets early. The thieves had an answer: they routed roughly $23.9M through USDD — a stablecoin Tether cannot touch — and swapped it to ETH via THORChain. Circle had a window to freeze 2.38M USDC after the wallets were flagged on October 12; it did not, and the funds moved October 14–15. Through it all, about 7,700 ETH went into Tornado Cash over eight days, exiting largely by way of Zcash — a route that trades traceability for the friction of shielded pools (Bitquery’s running ledger, which corrected its own early mislabeling of THORChain vaults as OTC desks, is the reference worth citing).
As of October 16, Bitquery could still see about $81M on-chain. That is the quiet headline of the whole affair: for all the laundering infrastructure, most of the haul has not vanished; it is parked where investigators — and anyone else — can watch it, and where issuer freezes can still bite if it surfaces at the wrong venue.
The accountability thread, restated fairly
What can be asserted without overreach: security researcher Joe Grand reported a Nano X implant to Ledger on March 4, 2026 (device bought August 2025 from an unauthorized Lazada Thailand seller, “LedgerXXX,” absent from the authorized-reseller list); per Grand’s account to Cointelegraph, the company acknowledged the report and said it was investigating internally — and it declined to comment on its handling of the disclosure when asked directly. Mark Karpelès says he is aware of at least two people who contacted Ledger about tampered devices as far back as December 2025, one of them Vietnamese crypto educator Tai Zen; that claim is Karpelès’ personal account, and Ledger has not confirmed receiving those earlier warnings. What is documented is that no public warning preceded the October 9 drains — the gap the whole accountability question turns on (Cointelegraph, our timeline piece).
What we still don’t know
An honest postmortem keeps its unknowns visible:
- Who did it. No arrests, no charges, no named suspects as of October 21.
- The real total. Ledger confirms none; $102.0M is the most complete third-party figure, and it includes criminal proceeds.
- The tampering point. Which link in the distribution chain — refurbishment, warehouse, transit — the implants entered at remains unestablished publicly.
- Scope beyond the reseller. Whether the units now under review from other purchase channels belong to the same operation.
- The European units. Whether the MediaMarkt devices connect to the CryptoBilis batch.
- The ownership question. Who acquired the reseller in March 2026, and whether any connection to the collection addresses exists — nothing established.
- Delivery. Whether Atom ships anywhere near summer 2027.
If you own a Ledger right now
The practical takeaways compress to three checks, expanded in our victim resource hub: confirm your purchase channel against Ledger’s authorized-reseller list, and treat any marketplace or third-party-reseller unit — sealed or not — as unfit for holding meaningful value; understand that a genuine-check cannot rule out this class of implant, because the attack adds hardware rather than tampering with the chip the check validates; and if you do replace a suspect device, generate the new seed phrase on the new hardware, never on the old one. For funds already exposed, the standard drill applies — new addresses from a clean device, and revoke what can be revoked while you still control the keys.
The industry context is worth one closing note: this case landed in a season of cold-storage failures — a Coinkite software flaw drained an estimated $130M in Bitcoin over the summer, and Trezor suffered a shipping-vendor breach exposing some 67,000 customers’ data. None of those broke cryptography either. The through-line of 2026’s hardware-wallet crises is that the math held every time; the companies, channels, and humans around the math are where every failure occurred. Watching $81M sit in plain sight while its owners face no arrests is not a story about weak security — it is a story about where security actually lives.
Frequently Asked Questions
How much was stolen in the Ledger hack?
The best current third-party estimate is $102.0M from 335 wallets across six chains (TRON, Bitcoin, Ethereum, Solana, BNB Chain, Polygon), per Bitquery's October 16 update. Ledger has explicitly not confirmed any total, stating that circulating figures come from third parties. The earlier $86M figure covered only the ten publicly shared collection addresses.
Is my Ledger wallet safe after the CryptoBilis hack?
All losses Ledger has confirmed trace to devices sold through Southeast Asian reseller CryptoBilis or parallel tampered units, not to Ledger's firmware or Secure Element. The implant is extra hardware glued inside the case — the device's genuine-check cannot detect it. If you bought from an authorized non-reseller channel (Ledger's own site), there is no confirmed case affecting you; if you bought via a third-party reseller or marketplace, treat the device as suspect regardless of sealed packaging.
Why did the loss estimate change from $86 million to $102 million?
Scope, not inflation. The first estimates counted only the ten collection addresses victims publicized on October 9. Bitquery later traced the thief's receiving pattern across six chains, including 11 TRON wallets missed early on, reaching 335 victim wallets and $102.0M by October 16. Our own first-day tally ($91.6M into the ten addresses) sat between the two because it measured cumulative inflows, not snapshot balances.
Has anyone been arrested for the Ledger hack?
No arrests or charges have been publicly confirmed as of October 21. Ledger says it is working with law enforcement and the SEAL 911 response group. The defensive wins so far are financial: Tether froze $10M in linked USDT, and investigators kept roughly $81M of the haul visible on-chain as of October 16.
What is the Ledger Atom, and does it fix the implant problem?
Atom is Ledger's new $899 device (founder edition $849) announced October 15, shipping 'summer 2027' pending certification, sold only through Ledger's own site and built in Ledger's Vietnam factory. It can detect physical tampering while powered off. It addresses the distribution attack by removing intermediaries, though Ledger's Stax shipped about a year late, so treat the date loosely.