$13.84 million in 48 hours: Arkham says the drainer is “still moving funds”

The attacker behind the so-called CryptoBilis Ledger drainer is not sitting still. The analytics firm Arkham Intelligence put the stolen holdings at 95.35 million dollars across 1,486 addresses on October 29, 2026, and noted that 13.84 million dollars had been moved on in the preceding 48 hours. For anyone holding a hardware wallet, that is the real news of the day: the case is three weeks old, but it is not closed.

Arkham wrote on X, quoted by crypto.news: “The CryptoBilis Ledger Drainer stole $95M, and is still moving funds.” A drainer is the technical term for a scheme in which an attacker empties a wallet completely as soon as they hold the access to it.

Arkham counts 95.35 million dollars across 1,486 addresses

The figure is an update, not a new discovery. When we picked up the case in mid-October, 86 million dollars and the question of the tampered devices were the focus. Arkham has since attributed further addresses. The outflows themselves fall between October 7 and October 9, 2026, according to the analysis.

Ledger has expressly not confirmed this total. The company points out that the estimates come from third parties and have not been verified by it. That is more than a formality, because the numbers diverge.

Bitquery arrived at 102 million dollars, Arkham at 95.35

The data firm Bitquery had named around 102 million dollars in an investigation published on October 16. Earlier analyses landed at 86 to 93 million dollars. Ranges like that arise because every analytics firm has to decide for itself which address it attributes to the attacker. Count an address that is later identified as someone else's, and the total comes out higher.

What holds up, therefore, is not the single round number but the range: between 86 and 102 million dollars, depending on attribution and cut-off date. The direction is the same across all the analyses, and it points upwards.

13.84 million dollars moved on within 48 hours

That funds are still in motion is the more important piece of information for those affected. Stolen holdings pushed across several addresses and blockchains usually end up at a service that swaps them into other money. That is exactly where investigators and stablecoin issuers step in, and that is where it is decided whether anything comes back from a theft.

Arkham currently attributes 30.44 million dollars to the addresses it has labelled. That is the portion that is visible and therefore, in principle, reachable. It is not an amount that victims would have a claim to, and it is no assurance that it will be frozen.

Tether keeps 10,000,010 USDT frozen on Tron

Part of the money has in fact been locked down. Following the intervention by stablecoin issuer Tether on October 9, 10,000,010 USDT sit frozen on the Tron blockchain. Freezing here means that the issuer puts the address in question on a blocklist, so the tokens there can no longer be transferred.

That works with centrally issued stablecoins, because there is an issuer who can intervene. With holdings that have no issuer, that lever does not exist. So anyone who wants to know how much of a theft is recoverable has to ask first what kind of value the loot sits in.

The implant read the 24-word recovery phrase during setup

The technical basis of the case was disclosed by Ledger's security division Donjon, and it is the reason this incident sits differently from an ordinary phishing attack. Affected devices contained an additional component. It intercepts the 24 words of the recovery phrase at the moment the device is set up and sends them out over the mobile network, using an eSIM that has been provisioned for the purpose.

The recovery phrase, also called the seed phrase, is the sequence of words from which all of a wallet's keys can be recalculated. Whoever holds it holds the funds, regardless of where the device happens to be. Reading it out during setup is therefore the complete loss of control, and that is why it did not help those affected that their device went on working normally afterwards.

Why the attack only became visible weeks later

Time can pass between the interception and the emptying, because the attacker decides for themselves when to strike. According to the analysis, the bulk of the outflows fell within a window of 51 minutes on October 9. Until then there was nothing for those affected to see: no suspicious update, no error message, no unusual transaction.

51 minutes on October 9: the window that carried most of the outflows

That bunching explains why the total reached three digits so quickly. The attacker already had the phrases and only had to trigger the transactions. For the investigation that is an advantage, because a narrow window makes it easier to attribute addresses. For those affected it was the worst case, because reacting within that time was practically impossible.

Secure element and operating system were untouched, Ledger's findings say

Ledger stresses one point that matters for every other device: the implant alters neither the secure element, the hardened chip in which the keys sit, nor the device's operating system. Nor does it interfere with transactions or signatures. The company also states that there is no indication that its own infrastructure or its direct sales channel has been compromised.

Two conclusions follow, one reassuring and one uncomfortable. The reassuring one: anyone who bought their device directly from the manufacturer is not affected by this route. The uncomfortable one: the security of a hardware wallet therefore does not rest on its technology alone, but also on whose hands it passed through before it was first switched on. To weigh a device against that yardstick, the common models and their supply routes are set out in our crypto hardware wallet comparison.

Ledger traces every confirmed case back to one retailer's devices

According to Ledger's own investigation, all confirmed thefts came from devices sold through the South-East Asian retailer CryptoBilis. Ledger Support stated on October 10: “Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant.”

How the components got into those devices, Ledger says it has not yet established. No accusation against the retailer is attached to this; CryptoBilis has suspended sales and shipments of Ledger devices for the duration of the investigation. Separately, The Record reported on the mechanism of the implant and the assessment by Ledger's security team.

MediaMarkt and Saturn halted sales, CryptoBilis halted shipments

For Germany, that is the concrete point of contact. After a report of a tampered device in the country, MediaMarkt and Saturn suspended sales of Ledger devices, and they did so before it was established whether the German case is connected to the series in South-East Asia. In parallel, Ledger has tightened its security requirements for retailers and stopped authorised sales in several South-East Asian markets.

Anyone who bought a device in a physical shop is in no worse a legal position than with any other defect. A tampered device is defective, and the claims lie against the seller, not the manufacturer.

What Ledger recommends to buyers of affected devices

The manufacturer's guidance distinguishes three situations. Anyone who bought a device from CryptoBilis and has not yet set it up should not set it up and should contact support. Anyone who has already set it up should move their holdings to a new device with a new recovery phrase. And anyone who has lost money should involve law enforcement before the device is opened, because the component is evidence.

That last point is easily overlooked. A device that has been unscrewed is worth considerably less to an investigation, and the temptation to take a look yourself is strong.

Police in Singapore report two further cases on October 28

On October 28, police in Singapore reported two cases of compromised wallets in which components may have intercepted recovery phrases or private keys. Ledger is examining further reports beyond those, among them one concerning a device bought at Singapore airport. A connection to the known series is not confirmed there.

Whether a second strand emerges from this is open. All that can be stated is that after three weeks the case keeps growing, in the number of reports as much as in the total.

A regulated alternative for anyone done with self-custody

A case like this also supports the opposite conclusion. Self-custody demands that you control the entire supply chain, from manufacture through to setup. Anyone unwilling to take that on can hand custody over, and under the EU's MiCA regulation that is done by providers with authorisation and supervisory obligations.

That choice has a price, and its name is counterparty risk: you trade responsibility for a device for trust in a company. There is no universally correct answer, only one that fits the sum involved and your own diligence.

Ledger drainer: 30.44 million sit on labelled addresses

1. Check which route your device was bought through, and keep the receipt. If a replacement is due, compare the supply routes in the hardware wallet comparison and buy from the manufacturer or from a retailer it names itself.
2. At any doubt, set up a new wallet with a new recovery phrase and move your holdings there. For the transition, or for small amounts, the software wallet comparison shows which applications are candidates.
3. Decide deliberately how much you want to hold yourself. Anything beyond that can sit with an authorised provider; the criteria for that are set out under regulated exchanges.

(As of October 29, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)