CryptoBilis-Linked Ledger Drainer Moved $13.84 Million in 48 Hours

A CryptoBilis-linked Ledger drainer moved $13.84 million over a 48-hour window, weeks after the main theft.

One estimate put the theft at $95.35 million across 1,486 addresses between Oct. 7 and 9. Addresses tagged to the drainer held $30.44 million, including 10,000,010 Tether (USDT) frozen on Tron. Tagged balances are not a confirmed recovery total, and the transfer figure does not establish whether the assets were sold or converted to cash.

A separate Oct. 16 estimate put the theft at $102 million from 335 victim wallets across six networks. The estimates remain unreconciled and use different snapshots and counting units: one counts addresses, while the other counts victim wallets.

Ledger's Oct. 15 response characterized the incident as a distribution-channel attack involving devices that had left its control. It said Ledger's chip, operating system and servers were not compromised; the response did not state a total loss figure. Earlier tracking of funds from the incident moving into Zcash (ZEC) documented another flow tied to the theft.

The Singapore Police Force (SPF) described separate cases in an Oct. 28 advisory, saying at least two incidents involving tampered Ledger devices had caused about $3.5 million in losses. The advisory did not specify the currency or link those cases to CryptoBilis. It said some devices were bought at retail stores in Singapore, investigations were ongoing and Ledger was reviewing the cases.