The loot should have vanished into the mixers. Yet it remains visible, step by step, on public blockchains. For several days, investigators have been following funds stolen from Ledger customers whose hardware wallets had all been bought from the same reseller. The case comes in a 2026 that has already been a heavy year for the crypto sector.
What is established, and what is estimated
The facts confirmed by Ledger are limited. The manufacturer has acknowledged the presence of an unauthorised hardware implant in at least one affected device. According to Journal du Coin, this confirmation dates from 10 October; Ledger then gave an update in a statement published on Sunday 11 October on X. All confirmed cases involve devices sold by CryptoBilis, a reseller active in Indonesia, Malaysia and the Philippines, listed as authorised on Ledger’s website. The manufacturer says its own systems and its direct sales channels were not affected, without saying how the devices were modified.
The amounts, for their part, are estimates based on public on-chain data: Ledger has not confirmed any total. Bitquery puts the figure at $93.2 million stolen from 315 wallets across six blockchains. The investigation platform YFarmX puts it at around $103.4 million across 530 addresses and seven blockchains, three quarters of it in USDT on Tron. Other estimates cited range from $86 million to $93 million.
How the loot moves
First link: the stablecoin issuer. Tether blacklisted 37 addresses linked to the theft as early as 9 October, freezing around 10 million USDT. This freezing power does not exist for bitcoin or ether. The hacker had anticipated it: on the very morning of the theft, he converted USDT into USDD, Tron’s stablecoin, via a module that Tether’s blacklist does not reach, then swapped the whole lot for ether on THORChain, a cross-chain exchange platform.
Second link: the mixer. YFarmX counted seven waves of deposits into Tornado Cash, a service that breaks the visible link between the wallet that deposits and the one that withdraws. The funds pass through pools of 100, 10 and 1 ETH, then come out within the hour to fresh wallets.
Third link: Zcash. In its “shielded” pools, the sender, the amount and the recipient of transactions are hidden. YFarmX nevertheless claims to have matched 108 out of 108 withdrawals to their original batch, “down to the zatoshi”, by analysing how the withdrawal transactions were constructed, who made them and when. This is a claim by the platform, not an independent verification. The funds that came out then financed sales of ZEC for USDC, paid into two wallets that held 1.79 million unspent USDC at the time of the investigation, a share that Circle, the issuer of USDC, could still freeze. The largest share of the loot, however, remains in ether, which no issuer can freeze.
An already heavy year
According to CertiK’s dashboard, updated on 12 October, hackers have taken $2.81 billion from the crypto sector since January, across 693 incidents. After $452.4 million frozen or returned, the net loss stands at $2.35 billion. October already accounts for $116.1 million across 26 incidents, most of it from the tampered Ledger devices.
The Ledger case stands out for its modus operandi. During the phishing campaign in April, a fake Ledger Live app cost $9.5 million to users who had entered their recovery phrase into it. This time, the attacker had the keys themselves: the victims made no mistake; it was the supply chain that was compromised.
What this means for holders in Switzerland
The confirmed cases involve a Southeast Asian reseller, and nothing in the available information indicates that devices sold in Switzerland are affected. The case is nonetheless a reminder that a hardware wallet is only as trustworthy as its provenance.
Ledger’s instructions are precise. Do not initialise a device bought from this reseller in the past 90 days. If it is already set up, transfer the funds to a new recovery phrase, on a device bought directly from the manufacturer. And bear in mind that no Ledger employee will ever ask for the 24 words.
Beyond this case, a few precautionary principles apply to every holder, in Switzerland as elsewhere: buy your device directly from the manufacturer rather than through an intermediary, inspect the device and its packaging on receipt, and treat with suspicion any recovery phrase that was not generated by the device itself during initialisation.
One question remains open: who will bear the losses. It has not been established that Ledger will compensate the victims, nor that the freezes obtained will lead to funds being returned.
