October 12, 2026

93M drained from Ledgers sold by one reseller. We followed the money, and found the thief under attack himself

On October 9, 315 wallets on 6 chains were emptied in under an hour, about $93M (Bitquery's count). The victims had one thing in common: their Ledger devices came from the reseller CryptoBilis (Malaysia, Indonesia, the Philippines).

WHAT WE KNOW

Ledger asked anyone who bought from this reseller in the last 90 days not to set up the device, and those who already did to move funds to a new seed. Mark Karpelès found a hidden module with an eSIM under the screen padding of a sealed Nano X from Malaysia. Ledger has not yet linked the module to the theft.

WHERE THE MONEY IS (our check, Oct 10, 17:00 UTC)

• 203.79 BTC (~$16.9M) sits in two addresses, untouched
• 12,649 ETH (~$31.7M) is in the thief's wallets; ~1,254 ETH went through Tornado Cash
• Gas for the thief's TRON address came from a Bybit withdrawal on September 24, a lead for investigators
• 1.06M USDC sits in 0xe2fc…9c11 after the mixer, and another 957K moved to 0x08ec…31a7. Circle hasn't blacklisted them yet, though it can

THE TWIST

Every time the thief moves funds, address-poisoning bots answer within minutes: zero-value transfers from look-alike addresses and fake "ETH" and "USDC" tokens. He hasn't fallen for it. Victims fall for it all the time.

WHAT TO DO

• Buy hardware wallets only from the maker's own store
• A seed phrase shown on a screen you don't trust may have leaked: move funds to a new one
• Before sending, check the whole address, not just the first and last 4 characters

All of the thief's addresses are in our check.

🔎 Check an address: https://amlconsensus.com/en