CryptoBilis Ledger Security Breach: $95 Million Stolen, $10 Million Frozen Amid Ongoing Investigations

Significant Security Breach in Cryptocurrency

In a significant security breach, a cryptocurrency drain linked to CryptoBilis Ledger has recently surfaced, leading to the transfer of approximately $13.84 million in stolen assets over the last two days. This comes following a thorough investigation by Arkham Intelligence, which uncovered a staggering total of $95.35 million siphoned from 1,486 different addresses between October 7 and 9.

Details of the Theft

Notably, $30.44 million of these stolen funds remain accessible within addresses that can be directly linked to the assailant, with $10 million of that sum being frozen in Tether (USDT).

The bulk of the theft was executed in a highly concentrated attack on October 9, wherein an audacious $80.60 million was amassed in just 51 minutes, beginning at 05:07:48 UTC. During this rapid window, the attacker managed to execute 335 transfers on the Tron blockchain, accumulating $58.19 million in USDT. In tandem, 112 Bitcoin addresses saw the transfer of 203.26 BTC, totaling about $16.73 million, processed in a single block shortly after the initial theft. Additionally, by 15:00 UTC the same day, the attacker had secured $14.14 million in USDT into Tron wallets.

Pre-Theft Movements and Assessments

Before the main event, smaller sums were moved into the attacker’s accounts between October 7 and 8, where approximately 7.41 BTC, valued at around $610,000, was gathered from 137 addresses. Different assessments of the total loss have emerged, with Bitquery previously estimating the stolen amount at around $102 million across various blockchain networks. However, Ledger has yet to provide an official confirmation of the total figures or the number of individuals affected.

Post-Theft Asset Movements

The shifting of assets by the thief did not halt post-theft; Arkham tracked around $69.19 million coursing through asset swaps and bridging techniques. Notable movements included the conversion of $20.37 million in USDT to USDD on Tron, along with further transfers that migrated USDT and USDC across multiple blockchains into Ethereum.

On October 9 alone, the attacker’s Ethereum wallets received a massive inflow of 5,895 ETH, equating to about $14.72 million, achieved via several bridges. Subsequently, they exchanged about $11.30 million in bridged USDT for roughly 4,530 ETH through Rizzolver. The investigation found that around 5,185 ETH, worth approximately $12.97 million, was allocated to new addresses.

Further Analysis and Findings

Post-theft analysis revealed that between October 9 and 11, $14.65 million in USDD was dispatched to twenty Tron addresses; soon after, 19 addresses converted the tokens back into USDT. Furthermore, Arkham noted deposits of 9,529 ETH worth about $23.27 million poured into Tornado Cash through numerous transactions, including significant numbers of transfers of various denominations of ETH.

The latest analysis also disclosed 4,932 ETH, valued at $11.49 million, and 111.28 BTC, worth around $8.96 million, located in tagged addresses. Moreover, an additional 10,000,010 USDT remains frozen on Tron due to Tether's intervention following the breach detected on October 9.

Ledger's Response and Security Measures

This analysis arrives in the wake of an investigation led by Ledger into security vulnerabilities concerning hardware wallets sold through CryptoBilis. Ledger publicly validated on October 13 that their security team identified an unauthorized implant in affected devices which could compromise recovery phrases during setup. Every confirmed case of theft was tied to these compromised devices, although the company had not determined how the malware infiltrated the hardware. In response to the crisis, Ledger has fortified security protocols for their resellers and curtailed the sale of hardware wallets in several Southeast Asian territories.

Related Incidents

In an alarming parallel, Singaporean authorities reported two incidents of wallet compromises on October 28, leading to losses of approximately SGD 3.5 million; preliminary findings indicated that the devices were also equipped with malicious components capable of extracting recovery phrases or private keys from users. Ledger clarified that its internal systems and direct sales processes had not been breached.