CryptoBilis Ledger hack: $95 million stolen, $10 million frozen

0Importance
closedStatus
2News media
Published
Updated

CryptoBilis Ledger losses were reported at $95.35 million across 1,486 addresses, with some funds still sitting in tagged wallets and $10 million in USDT frozen. Singapore police also tied tampered Ledger hardware wallets to at least two cases involving $2.7 million in losses.

Key claims & sources

✓
Arkham put the CryptoBilis Ledger drainer’s losses at $95.35 million across 1,486 addresses, and said $13.84 million moved in the previous 48 hours.
✓
Arkham said the CryptoBilis Ledger drainer took $95.35 million from 1,486 addresses and $13.84 million moved in the past 48 hours.
✓
The CryptoBilis Ledger exploit was described as leaving $30.44 million in tagged wallets, with stolen funds traced across Tron, Ethereum, Bitcoin, and cross-chain bridges.
✓
Tether froze $10 million in USDT, and Singapore police said tampered Ledger hardware wallets were linked to at least two cases and $2.7 million in losses.

What it means

Ledger hardware wallets are built to keep private keys offline, so reports of tampered devices point to a breakdown at the device layer rather than on a blockchain itself. This case is tied to CryptoBilis Ledger and spans activity seen across Tron, Ethereum, Bitcoin, and cross-chain bridges. The fact that Singapore police also linked tampered wallets to at least two cases shows that the issue extends beyond one on-chain incident.

For people who use Ledger devices, the immediate consequence is a sharper need to verify hardware integrity and transaction details before signing. Tether’s freeze of $10 million in USDT shows that some stolen funds can be stopped once they are identified in circulation. Funds still held in tagged wallets remain visible, but that does not by itself restore access to the victims.

This case highlights a tension between self-custody and the reality that hardware can be compromised before a user ever signs a transfer. Cross-chain movement makes tracing and recovery more complicated, while freezes by a stablecoin issuer show that parts of the crypto system can intervene after the fact. That creates a split system in which control is partly with users and partly with intermediaries.

Market reaction i

ArkhamARKM the event is about this asset

Arkham rose 1.4% in the 4 hours after the first headline, after rising 0.4% in the 2 hours before.

$0.1178 price at the headline
+0.4% 2 h before
+1.4% 4 h after
-5.4% 12 h after
First headline

48 prices, one every 30 minutes

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 29 09:34
crypto.news scoop
Breaks the event: $95M and $10M
+1 d 3 h
Oct 30 13:00
The Coin Republic adds
Breaks the figures down; the largest, $80.6M, with quotes

Thefts of a similar size

WhenWhat happenedFigure
3 months ago Coldcard · Firmware vulnerability incident $100M
1.6 years ago Bitget · Market Maker Bot Exploited incident $100M
31 days ago Ledger (Supply Chain) · Supply Chain Attack incident $93M
5.2 years ago Liquid · Wallet stolen incident $91.3M
1.4 years ago Nobitex · Malware incident $90M

4285 incidents stored · 81 were as large as this one or larger ($95M)