CryptoBilis Ledger hack: $95 million stolen, $10 million frozen

cryptonews10-29 17:34

The CryptoBilis Ledger drainer has continued moving stolen cryptocurrency, transferring USD 13.84 million over the past 48 hours after Arkham Intelligence traced USD 95.35 million in thefts involving ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2679479637?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-10-29 17:34","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2679479637","market":"other","top_or_hot":-1,"title":"CryptoBilis Ledger hack: $95 million stolen, $10 million frozen","media":"cryptonews","content":"<div>\n<p>The CryptoBilis Ledger drainer has continued moving stolen cryptocurrency, transferring USD 13.84 million over the past 48 hours after Arkham Intelligence traced USD 95.35 million in thefts involving ...</p>\n\n<a href=\"https://crypto.news/cryptobilis-ledger-drainer-95m-stolen-funds/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>CryptoBilis Ledger hack: $95 million stolen, $10 million frozen</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nCryptoBilis Ledger hack: $95 million stolen, $10 million frozen\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-10-29 17:34 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/cryptobilis-ledger-drainer-95m-stolen-funds/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>The CryptoBilis Ledger drainer has continued moving stolen cryptocurrency, transferring USD 13.84 million over the past 48 hours after Arkham Intelligence traced USD 95.35 million in thefts involving ...</p>\n\n<a href=\"https://crypto.news/cryptobilis-ledger-drainer-95m-stolen-funds/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BTF","symbol_name":"比特币&以太币期货ETF-CoinShares","start_time":0,"source_url":"https://crypto.news/cryptobilis-ledger-drainer-95m-stolen-funds/","article_id":"2679479637","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/cryptobilis-ledger-drainer-95m-stolen-funds/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2679479637","pubTimestamp":1793266474,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"The CryptoBilis Ledger drainer has continued moving stolen cryptocurrency, transferring USD 13.84 million over the past 48 hours after Arkham Intelligence traced USD 95.35 million in thefts involving 1,486 addresses.Arkham traced USD 95.35 million stolen from 1,486 addresses between October 7 and 9.The attacker reportedly stole USD 80.60 million within just 51 minutes on October 9.The attacker deposited 9,529 ETH, worth USD 23.27 million, into Tornado Cash through 559 transactions.Arkham identified USD 30.44 million in remaining holdings, including USD 10 million in frozen USDT.According to Arkham Intelligence, the thefts occurred between October 7 and 9, with most of the cryptocurrency taken during a 51-minute period on October 9. The blockchain analytics firm reported that USD 30.44 million remains in addresses linked to the attacker, including USD 10 million in USDT frozen by Tether.CryptoBilis Ledger Drainer Stole USD 80.6 Million in 51 Minutes. After the theft, the attacker began ","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"BTF":"比特币&以太币期货ETF-CoinShares","EZET":"以太坊ETF-Franklin","BITQ":"Bitwise Crypto Industry Innovators ETF","YBTC":"比特币看涨期权ETF-Roundhill","BRRR":"比特币ETF-CoinShares","CROC":"ProShares UltraShort Australian Dollar ETF","AETH":"以太坊策略ETF-Bitwise","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","BKCH":"AdvisorShares Sabretooth ETF","OOQB":"One+One Bitcoin and Ether ETF","STCE":"Schwab Crypto Thematic ETF","BTCI":"NEOS Bitcoin High Income ETF","BTFX":"比特币期货ETF-CoinShares","ETHW":"以太坊ETF-Bitwise","GDLC":"Grayscale CoinDesk Crypto 5 ETF","IBIT":"比特币ETF-iShares","MSBT":"Morgan Stanley Bitcoin Trust ETP","ARKY":"ARK Active Autocallable Income ETF","ETHV":"以太坊ETF-VanEck","BEGS":"RAREVIEW 2X BULL CRYPTOCURRENCY & PRECIOUS METALS ETF","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","EUFX":"ProShares Short Euro ETF","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","HECO":"SPDR Galaxy Hedged Digital Asset Ecosystem ETF","ETHU":"2倍以太币期货ETF-Volatility Shares","QETH":"以太坊ETF-Invesco Galaxy","MAXI":"比特币期货ETF-Simplify","ETH":"低成本以太坊ETF-Grayscale","ETU":"T-Rex 2X Long Ether Daily Target ETF","ETHT":"ProShares Ultra Ether ETF","ETTY":"Amplify Ethereum 3% Monthly Option Income Etf","USD":"ProShares Ultra Semiconductors","BETE":"等权重比特币&以太币期货ETF-ProShares","ETHA":"以太坊ETF-iShares","YETH":"Roundhill Ether Covered Call Strategy ETF","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","BETH":"比特币&以太币期货ETF-ProShares","FETH":"以太币ETF-Fidelity","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","MNRS":"GRAYSCALE BITCOIN MINERS ETF","ETHD":"ProShares UltraShort Ether ETF","EETH":"以太币期货ETF-ProShares","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","ETHE":"最大以太坊ETF-Grayscale"},"translate_title":"CryptoBilis 账本黑客攻击：9500 万美元被盗，1000 万美元被冻结","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"BKCH":0.9,"ETHD":0.9,"EZET":0.9,"ARKY":0.9,"BTCmain":0.85,"IBIT":0.9,"BTCZ":0.8,"CBTJ":0.8,"BRRR":0.7,"CROC":0.9,"OOQB":0.9,"QETH":0.9,"MSBT":0.8,"ETHW":0.9,"ETHU":0.9,"ETHE":0.9,"XBTmain":0.85,"MNRS":0.8,"ETH":0.9,"ETHV":0.9,"HECO":0.9,"STCE":0.9,"BTFX":0.8,"ETTY":0.9,"BETH":0.9,"BITQ":0.9,"YBTC":0.8,"AETH":0.9,"YETH":0.9,"BTF":0.9,"METHmain":0.9,"BEGS":0.9,"FETH":0.9,"USD":0.9,"ETHT":0.9,"EUFX":0.9,"LFGY":0.9,"ETU":0.9,"BETE":0.9,"EETH":0.9,"MAXI":0.8,"CRPT":0.9,"NCIQ":0.9,"BTCI":0.8,"ETHA":0.9,"GDLC":0.9,"BTCL":0.8},"content_text":"The CryptoBilis Ledger drainer has continued moving stolen cryptocurrency, transferring USD 13.84 million over the past 48 hours after Arkham Intelligence traced USD 95.35 million in thefts involving 1,486 addresses.\n\n\nSummary\n\n\n\nArkham traced USD 95.35 million stolen from 1,486 addresses between October 7 and 9.\nThe attacker reportedly stole USD 80.60 million within just 51 minutes on October 9.\nAt least USD 69.19 million passed through swaps and bridges across multiple blockchain networks.\nThe attacker deposited 9,529 ETH, worth USD 23.27 million, into Tornado Cash through 559 transactions.\nArkham identified USD 30.44 million in remaining holdings, including USD 10 million in frozen USDT.\n\n\n\nAccording to Arkham Intelligence, the thefts occurred between October 7 and 9, with most of the cryptocurrency taken during a 51-minute period on October 9. The blockchain analytics firm reported that USD 30.44 million remains in addresses linked to the attacker, including USD 10 million in USDT frozen by Tether.\nIts latest investigation traced the stolen cryptocurrency through several blockchain networks, identifying transfers involving USDT, Bitcoin, Ethereum and USDD. The findings come nearly three weeks after Ledger began investigating reports of missing funds from customers who purchased hardware wallets through Southeast Asian reseller CryptoBilis.\n\nThe CryptoBilis Ledger Drainer stole $95M, and is still moving funds.The drainer stole $95.35M from 1,486 addresses on 7-9 October: it holds $30.44M in tagged addresses with $10M frozen.The drainer is still moving funds, with $13.84M moved in the past 48 hours. pic.twitter.com/DLZRBAWGvU— Arkham (@arkham) October 29, 2026\n\nCryptoBilis Ledger Drainer Stole USD 80.6 Million in 51 Minutes\nArkham’s analysis found that most of the theft occurred on October 9, beginning at 05:07:48 UTC. Within 51 minutes, the attacker collected USD 80.60 million, including USD 58.19 million in USDT through 335 transfers on the Tron blockchain.\nDuring the same period, 112 Bitcoin addresses transferred 203.26 BTC, valued at USD 16.73 million, in a single block at 05:54 UTC. Another USD 14.14 million in USDT reached the attacker’s Tron wallets by 15:00 UTC.\nSource: Arkham\nThe investigation identified smaller transfers before the main theft. Between October 7 and 8, the attacker received 7.41 BTC, worth approximately USD 610,000, from 137 addresses.\nPrevious estimates of the losses have varied. Blockchain analytics firm Bitquery estimated USD 102 million stolen from 335 wallets across six networks in its October 16 investigation. Ledger has not independently confirmed the total amount stolen or the number of affected customers.\nStolen Funds Moved Through Ethereum Bridges and Exchanges\nAfter the theft, the attacker began converting the stolen assets and moving them between blockchain networks. Arkham traced at least USD 69.19 million through swaps and bridging transactions, including USD 20.37 million in USDT converted into USDD on Tron.\nAnother USD 20 million in USDT moved from Tron to Ethereum through USDT0. Other transfers converted USDT and USDC from Tron, BNB Chain and Polygon into ETH, including USD 8.95 million through Relay, USD 5.91 million through Chainflip and USD 13.96 million through smaller routes.\nOn October 9, Ethereum wallets associated with the attacker received 5,895 ETH, worth USD 14.72 million, from bridges including Relay, THORChain, NEAR Intents, Bridgers and Mayan. The attacker then converted USD 11.30 million in bridged USDT into approximately 4,530 ETH through Rizzolver.\nSeparate transfers sent 5,185 ETH, valued at USD 12.97 million, directly to newly created addresses. Of that amount, 3,600 ETH came from USD 9 million transferred through USDT0, while another 1,585 ETH moved through Chainflip to three new addresses.\nBetween October 9 and 11, the attacker sent USD 14.65 million in USDD to 20 Tron addresses. Nineteen subsequently converted the tokens into USDT through SUN.io and deposited USD 14.13 million into THORChain.\nTornado Cash Received USD 23.27 Million in Stolen ETH\nArkham identified 9,529 ETH, valued at USD 23.27 million, deposited into Tornado Cash through 559 transactions.\nThe deposits included 63 transfers of 100 ETH, 307 transfers of 10 ETH, 156 transfers of 1 ETH and 33 transactions of 0.1 ETH. Before the deposits, 8,102.6 ETH had moved from wallets linked to the attacker into 26 new Ethereum addresses.\nBitcoin transfers continued separately. Arkham traced 102.15 BTC, worth USD 8.33 million, leaving the attacker’s wallets through four transactions. On October 27, a 17.97 BTC portion joined 52.51 BTC in an unspent output containing 70.47 BTC, worth USD 5.67 million.\nThe firm’s latest figures show 4,932 ETH worth USD 11.49 million and 111.28 BTC worth USD 8.96 million in tagged addresses. Another 10,000,010 USDT remains frozen on Tron following Tether’s October 9 intervention.\nLedger Confirmed Hardware Implant in CryptoBilis Wallet Investigation\nThe findings follow Ledger’s investigation into compromised hardware wallets sold through CryptoBilis. As crypto.news previously reported, Ledger confirmed on October 13 that its security team had discovered an unauthorized hardware implant capable of capturing recovery phrases displayed during device setup.\nLedger said every confirmed theft it had investigated involved a device purchased through CryptoBilis, although it had not established how the components entered the affected hardware. The manufacturer subsequently tightened reseller security requirements and suspended authorized hardware wallet sales across several Southeast Asian markets.\nIn a related development, Singapore police reported two compromised wallet cases on October 28, involving approximately SGD 3.5 million in cryptocurrency losses. Preliminary investigations found that malicious components inside the affected devices could capture users’ recovery phrases or private keys.\nLedger said its investigation had not identified evidence that its internal systems or direct sales channels were compromised.\n\n\n\n\n\n                Read more:\n            \n\n                Why is Bitcoin price down today despite spot Bitcoin ETF inflows?","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.52.0","shortVersion":"4.52.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2679479637","isCrawlerRequest":true}