Weekly Research Brief: Ledger’s $91M Theft, Papertrade

What it is

Galaxy Research's account of the roughly $91M theft from Ledger hardware wallets sold through CryptoBilis, a Southeast Asian reseller that Ledger's own site listed as authorized for Indonesia, Malaysia and the Philippines. The summary covers the outline. This adds Ledger's remediation guidance, the implant's evolution, and the loss breakdown.

How it works

A separate component inside the enclosure reads the screen during setup, captures the 24-word phrase, and sends it out over LTE through a provisioned eSIM. The Secure Element and Ledger's OS are untouched, so Genuine Check passes on a tampered unit. Independent teardowns found at least three implant generations, the latest a professionally fabricated flex circuit under the display.

Ledger says its own systems and direct channels were not compromised. Every confirmed case so far involves a CryptoBilis device.

Preconditions / Affected

• The device was bought through CryptoBilis. Ledger's guidance covers purchases in the past 90 days.
• Some stolen addresses date to 2021, which Galaxy reads as existing seeds restored onto tampered devices. A new device can therefore compromise an old wallet.
• Galaxy's count is 474 victim addresses, a floor because BNB Chain is not scoped:
• TRON: about $64.5M (USDT and TRX) from 146 addresses
• Bitcoin: 213 BTC (about $17.6M) from 279 addresses
• Ethereum-type: $8.8M from 49 addresses

What to do

Ledger's stated guidance for anyone who bought from CryptoBilis in the past 90 days:

• If the device is not yet set up, do not set it up.
• If it is set up, move funds to a new device with a newly generated seed.

Galaxy's general advice:

• Buy direct from the manufacturer.
• Treat any device that arrives already set up, or with a pre-printed seed, as compromised.
• For balances you cannot afford to lose, spread keys across vendors and locations, so one tampered device or bad RNG is a scare rather than a loss.
• Institutions should use custody controls that assume any one device or vendor can fail.

Caveats

• The funds are largely unrecoverable. About $56.6M was still at attacker addresses as of Oct. 15, including roughly 208 BTC untouched. Only Tether's $10M freeze is under anyone's control but the thief's.
• About 5,400 ETH ($13.5M) has gone through Tornado Cash, and about $2M appears to have reached exchange deposits.
• Ledger calls the volume "limited". Galaxy's tally shows hundreds of addresses.
• Galaxy's wider framing is its own opinion. It names the Coldcard weak-seed, Liquid and Bitget incidents as part of a pattern, and says none of them has been attributed to AI tooling.