The cryptocurrency theft investigation involving Ledger hardware wallets sold through Southeast Asian reseller CryptoBilis has expanded to an estimated $102 million, while a separate report of another allegedly modified Ledger device purchased in Europe is raising fresh questions about the security of retail distribution channels.
Blockchain intelligence firm Bitquery revised its estimate on October 12 after identifying nine additional TRON wallets drained of 8.8 million USDT during the original October 9 attack. Its latest on-chain investigation now attributes approximately $102 million in losses to 324 wallets across six blockchain networks.
The update also reveals further movement of suspected stolen funds through THORChain, Tornado Cash and Zcash. Meanwhile, a European customer says he discovered similar suspicious hardware modifications in a second Ledger purchased from a different MediaMarkt store. Ledger has not independently confirmed the European findings or established that they are connected to the CryptoBilis thefts.
Nine Additional TRON Wallets Push Estimated Losses Above $100 Million
Bitquery’s October 12 update, published at 14:00 UTC, increased its earlier estimate of $93.2 million across 315 wallets to $102 million across 324 wallets.
The additional losses came from nine TRON wallets emptied in a single block at 20:49 UTC on October 9. Investigators identified the transfers during a subsequent review of blockchain activity, rather than through a new attack on October 12.
The six affected networks are TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. TRON accounts for approximately $79.3 million of the estimated losses, followed by Bitcoin at $16.8 million and Ethereum at $3.7 million.
Bitquery calculates losses based on assets leaving victim wallets, excluding subsequent transfers between attacker-controlled addresses to avoid double-counting. The 324-wallet figure does not necessarily represent 324 individual victims, as one person may control multiple wallets.
The investigation also found that the attacker had conducted small transactions over approximately two weeks before the mass withdrawals. During the attack, 25 TRON wallets signed approvals granting access to the same address within three seconds, supporting the theory of coordinated control over multiple compromised keys.
THORChain Replaces Earlier Binance Lead as Funds Move Into Ethereum
Bitquery issued a significant correction at 12:00 UTC on October 12, withdrawing an earlier interpretation of four TRON addresses as an over-the-counter trading group.
The addresses were actually THORChain vaults used to process cross-chain swaps. Transfers previously interpreted as evidence that stolen assets reached Binance belonged to unrelated THORChain users.
The correction follows a separate THORChain wallet attribution dispute involving PeckShield and Arkham, highlighting the risks of treating transactions through shared infrastructure as evidence of direct criminal activity.
According to Bitquery, the attacker routed approximately 24.9 million USDT through 32 THORChain swaps between October 9 and 12, receiving roughly 9,847 ETH. The remaining USDD was also converted through THORChain, with the final transfers occurring shortly after 13:30 UTC on October 12.
The investigation additionally identified approximately 3,690 ETH entering Tornado Cash in subsequent transactions, bringing the cumulative amount routed through the mixing protocol to roughly 6,680 ETH.
Bitquery estimates that around $82 million remained traceable on-chain at its October 12 accounting snapshot. However, traceable funds are not necessarily recoverable assets.
Tether had frozen approximately $10 million in USDT across 20 wallets. Bitquery also identified two addresses it considers likely connected to the attacker holding another 2.38 million USDC that Circle could potentially freeze. Those USDC balances had not been confirmed as frozen in the update.
Second MediaMarkt Purchase Raises European Distribution Questions
Separately, an X user identified as Johannes reported on October 12 that he purchased another Ledger hardware wallet from a different MediaMarkt location in Europe and discovered what appeared to be additional internal cables and an LTE communications module.
Johannes said he recorded the unboxing and found modifications similar to those in a previously purchased device. His initial finding had already raised concerns about a possible Ledger hardware implant in Europe.
According to his account, store personnel indicated that the second device was not a returned product and that returned Ledger wallets were normally sent back to the manufacturer. He also said inventory records identified Aqipa GmbH as the supplier.
The buyer reported that the first device had been submitted for independent examination and that the second was being sent to Ledger. Neither the alleged modifications nor the complete distribution history of the devices has been independently established.
Ledger previously confirmed an unauthorized hardware implant in one affected customer’s device. However, its October 11 statement said all confirmed cases associated with the October 9 draining incident involved devices sold through CryptoBilis. Ledger maintained that its own systems and direct sales channels were unaffected.
The company has not confirmed a broader European supply-chain compromise, and the two European purchase reports do not establish that MediaMarkt, Aqipa or any other distributor participated in tampering.
Why Freezing Stablecoins May Be the Best Recovery Opportunity
The movement of stolen assets reveals a difficult but important distinction for investors: tracing cryptocurrency is not the same as recovering it.
Tether’s intervention demonstrates that centralized stablecoin issuers can prevent identified tokens from moving. Yet that capability becomes less useful once stolen USDT has been converted into ETH, moved between networks or routed through privacy systems.
The outstanding $2.38 million in USDC therefore deserves attention. If Circle can verify the wallet connections and receives a valid basis for intervention, those balances could provide another opportunity to preserve assets before further transfers occur.
There is no guarantee that the addresses belong to the attacker or that freezing would lead to reimbursement. Bitquery itself assigns varying confidence levels to the wallet connections reconstructed after Zcash transactions.
The immediate opportunity for investigators lies in combining blockchain evidence with service-provider records rather than relying exclusively on transaction clustering.
The Bigger Risk Is Trust in the Hardware Wallet Supply Chain
The European reports could eventually become more consequential than another increase in the estimated stolen amount.
Hardware wallets are marketed around a straightforward promise: keeping private keys away from devices connected to the internet. But that protection depends on the integrity of the physical wallet before its owner begins using it.
An unauthorized component capable of observing recovery-phrase information during setup could undermine that protection without necessarily compromising the underlying cryptographic hardware.
This makes purchasing history and device initialization dates especially important. An earlier case involving an eight-year-old wallet drained after funds were moved to a new Ledger illustrates why investigators need to examine whether credentials were exposed during migration rather than simply identifying when coins disappeared.
For Ledger, the commercial risk extends beyond immediate theft losses. If independent examinations establish that modified devices reached multiple unrelated authorized retail channels, customers may begin questioning how much protection authorized-reseller status actually provides.
Manufacturers could face pressure to strengthen inventory controls, physical inspections, shipment tracking and procedures for returned devices. Retailers and distributors may also need to demonstrate that products remain secure throughout the distribution process.
What Could Change the Investigation Next?
There are now two separate questions that could materially alter the direction of this case.
The first is whether investigators can preserve additional assets before they disappear into less transparent channels. The second is whether forensic examinations connect the alleged European implants to the confirmed Southeast Asian case.
A matching implant design would be a useful clue, but it would not automatically prove a shared point of compromise. Investigators would still need purchase records, manufacturing identifiers, shipment histories and evidence establishing when the modifications were introduced.
The financial implications also depend on how widely the incident extends. A limited reseller-specific compromise would create a very different risk profile from evidence of tampering across multiple independent distribution routes.
For cryptocurrency holders, the immediate lesson is more practical than theoretical. Moving funds onto a newly purchased device is not necessarily safer if the device or its recovery phrase has already been compromised. Reusing an exposed recovery phrase on replacement hardware does not eliminate that vulnerability.
Until more devices have been independently examined, Bitquery’s expanding loss estimate offers stronger evidence about the scale and movement of the stolen assets than about the original point of compromise. Establishing that distinction will determine whether this remains a concentrated reseller incident or develops into a much wider hardware-wallet security problem.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574