hack or exploit

Binance Founder CZ Flags NDA Twist in $80M+ Ledger Wallet Hack

0Importance
closedStatus
3News media
3Pieces
Published

Ledger said one affected device contained an unauthorized hardware implant and said its systems were not breached, while also pausing reseller sales pending investigation. Separately, Ledger advised CryptoBilis buyers to keep unused wallets uninitialized and to move assets from already-set-up devices to a new device with a new recovery phrase.

Key claims & sources

✓
CZ raised questions about an NDA tied to a Malaysian reseller’s ownership transfer in an investigation involving an $80 million-plus Ledger wallet theft.
✓
Bitquery said it traced $93.2 million in alleged losses across 315 wallets on six blockchains.
✓
Ledger told CryptoBilis buyers to leave unused wallets uninitialized and to move assets from already-set-up devices to a new device with a new recovery phrase.

What it means

Owners and buyers who use Ledger devices are the most immediate audience, because the guidance changes what they should do with wallets that have not been initialized and with devices that have already been set up. Anyone handling a device linked to CryptoBilis would notice that Ledger’s instructions now point to moving assets to a fresh device with a new recovery phrase.

In practice, the situation narrows what can safely be done with some devices and reseller channels, because Ledger said one device had an unauthorized hardware implant and that reseller sales were halted pending investigation. At the same time, Ledger’s denial of a breach to its own systems means the devices and the company’s systems are being treated separately in the public record.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market
first headline
+0.1% 2 h before
+0.1% 4 h after
$2.8Tmarket cap at publication
12data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 14 16:30
The Coin Republic scoop
Breaks the event: $93.2M and $80M
+10 h 24 m
Oct 15 02:53
The Defiant context
Its angle: uninitialized, defiant, phrase
+19 h 11 m
Oct 15 11:40
crypto.news context
Its angle: suspended, attackers, tightens

Thefts of a similar size

WhenWhat happenedFigure
1.4 years ago Nobitex · Malware incident $82M
2.9 years ago Orbit Bridge · Signature Verification Flaw incident $81.7M
4.5 years ago Fei Protocol & Rari Capital · Reentrancy attack incident $80M
4.8 years ago Qubit · Missing Input Validation incident $80M
5.9 years ago Compounder.Finance · Project owner internal operations incident $80M

4282 incidents stored · 94 were as large as this one or larger ($80M)