Ledger hack scare nears $90 million as Tether moves to freeze stolen USDT

Suspected Ledger wallet thefts are approaching $90 million as Tether freezes USDT stablecoin linked to the incident, according to blockchain investigators.

In an Oct. 9 statement, the crypto hardware wallet maker said it was investigating reports that customers lost funds after buying devices from CryptoBilis, an authorized reseller operating in Southeast Asia.

As a precaution, the company asked the distributor to immediately pause sales and shipments of its hardware wallets while the investigation continues.

Ledger also advised customers who purchased devices from CryptoBilis in the past 90 days not to initialize them if they had not yet completed setup.

Those who had already configured their wallets were urged to consider transferring their cryptocurrency to a new Ledger device initialized with a fresh recovery phrase.

CryptoBilis appears in Ledger's official reseller directory for Malaysia, Indonesia, and the Philippines. Customers buying through authorized distribution channels generally rely on those relationships to reduce the risk of receiving counterfeit or compromised hardware.

The incident has drawn attention from Binance founder Changpeng Zhao, who warned users to exercise caution, particularly if they had recently purchased a Ledger device.

He wrote on X:

“Based on information so far, it seems to be localized to a supply chain attack with one vendor.”

He suggested that a limited number of customers may have received counterfeit or tampered devices, while emphasizing Ledger's longstanding security reputation.

Zhao also called for cooperation across the cryptocurrency industry to identify the suspected attackers and recover the stolen assets.

He added:

“I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds.”

Meanwhile, former Mt. Gox CEO Mark Karpelès is investigating whether malicious hardware components were inserted into devices distributed to customers.

Karpelès asked CryptoBilis to open some of its unsold Ledger wallets so their internal circuit boards could be inspected for possible spying implants or other unauthorized modifications.

The concern draws attention to a limitation in Ledger's hardware authentication process.

The company's security documentation acknowledges that its Genuine Check system verifies a device's Secure Element but cannot necessarily identify physical modifications elsewhere in the hardware if the original security chip remains intact.

That means a physically altered device could pass authentication even if it contains unauthorized components.

No confirmed evidence shows that malicious hardware implants caused the reported thefts. Ledger has not disclosed how many devices may have been compromised or established whether the incident resulted from counterfeit hardware, physical tampering, or another attack method.

While Ledger examines the suspected source of the compromises, blockchain investigators are attempting to trace and restrict the movement of stolen cryptocurrency.