Ledger's official reseller was sold in secret. Then $91 million moved

203 BTC moved to two new addresses in a single block.

In the same hour, about $58 million in USDT moved on the Tron network. One long thread puts the total at about $91 million. It all follows one photo of a Ledger wallet cracked open.

The photo shows a hidden extra board under the screen. It carries a mobile modem and an eSIM, the tiny SIM card chip found inside most phones. If the thread is right, a gadget sold to keep crypto offline had a line built in to send secrets out.

The thread, posted on 9 October and seen 268,900 times, joins the dots. We first looked at the viral drain claims here, when nothing could be proven. Now there is a named shop, a Ledger statement and money moving on-chain. Ledger has not said how the losses happened.

Who is Cryptobilis, and why did Ledger list it?

Cryptobilis is a shop in Malaysia. The thread says Ledger's own website has listed it as an official, authorised reseller since at least 2022. It covers Malaysia, Indonesia and the Philippines.

Then the shop changed hands. The thread says the founders sold it this spring, and signed a non-disclosure agreement (NDA) saying they would not reveal the sale until 19 October. By August, the company registry showed one owner holding 100%, registered in Heilongjiang, China.

The shop kept its name. It also kept its "authorized by Ledger" badge.

The thread's author adds a warning of their own. Nobody has officially tied the new owner to the bugged devices.

What was hiding under the screen?

On 8 October, a crypto developer who posts as MagicalTux shared photos of a Ledger he had taken apart. Behind the screen sat an extra board. On it were an LTE modem, an antenna, an eSIM and a small chip, according to reports on his photos.

A security researcher at the firm SlowMist guessed how it could work. Here is the simple version.

When you set up a Ledger, its secure chip makes your 24-word recovery phrase. Those words are the master key to your coins. The screen then shows them one at a time so you can write them down. A hidden board wired into the screen could copy each word as it appears. Then the modem sends the list out over mobile data.

No Wi-Fi needed. No cable. Just a phone signal.

Photo: Ingo Dierking / Wikimedia Commons, CC BY-SA 4.0

Neither the photos nor this explanation has been confirmed by Ledger. One crypto news site also notes that nothing yet proves the opened device was sold by Cryptobilis. The developer says his came from Malaysia.

Why did Ledger's genuine check say it was fine?

Ledger's app has a "genuine check". It asks the device to prove its chip is a real Ledger chip.

The thread says that check missed the extra board because the Ledger chip inside is real. The spy board sits outside it, wired to the screen. The test asks "Is the chip real?" and the answer is yes.

That is the scary part. A buyer who ran every official check could still see a green tick.

How much money moved, and when?

The numbers come from the thread and from on-chain trackers. None is confirmed by Ledger. Here is the timeline as reported.

Other counters give lower and higher totals. Their figures differ because they trace different wallets.

$72.00tanuki42

$86.90Specter

$91.00The thread

$92.90Bitquery

See the numbers

tanuki42	$72.00
Specter	$86.90
The thread	$91.00
Bitquery	$92.90

Source: The thread (9 Oct 2026) and on-chain trackers as reported by CryptoTicker and KuCoin News. Ledger has confirmed no figure.

Bitquery counts about 311 wallets. Specter counts about 98. The chain analytics firm Chain INK says its 98 wallets held about $888,000 each on average.

Those are not small savers. Whoever got those phrases picked wallets with real money in them.

Photo: JulianVilla26 / Wikimedia Commons, CC BY-SA 4.0

What has Ledger actually said?

Ledger Support said it is investigating losses by users in South East Asia. Every user shares one thing, they bought from Cryptobilis. Ledger asked the shop to stop all sales and shipments.

Its advice, as reported by crypto news sites, is simple.

• Bought from the shop in the past 90 days? Do not switch on a device you have not set up yet.
• Already stored coins on one? Move them to a new device, with a brand new recovery phrase.

Crypto news sites also say some stolen USDT has been frozen by Tether and that some funds went through a mixing service. One outlet writes that Ledger itself was not hacked.

Ledger has not said whether the new owner is linked to the devices. It has not said how the board got in.

How do you check the Ledger you already own?

Here is what the facts so far suggest. None of this is advice to move money. It is a sensible check list.

1. Look at where you bought it. Direct from Ledger, or a shop you chose yourself?
2. Never use a device that arrived opened, set up, or with a recovery card already filled in.
3. Make your own 24 words on a device you trust, and never type them into a phone or computer.
4. If your Ledger came from the shop named in the thread, read Ledger's latest advice before you switch it on.
5. Treat any "authorised seller" badge as a promise with a date on it.

That last point is the uncomfortable one. The badge was earned in 2022. It said nothing about who owned the shop in 2026.

The sale was meant to stay secret until 19 October. The money moved ten days earlier.