The Ledger wallet drains of 9 October 2026: what the chain shows

On 9 October 2026, users of Ledger hardware wallets in Southeast Asia began reporting drained wallets, and reports link the losses to devices sold by the reseller CryptoBilis. We read the public blockchain for the addresses a researcher published. In short: four Tron addresses received about 65.2 million USDT within hours and forwarded all of it, two Bitcoin addresses that held 203.79 BTC unspent on 11 October had moved all of it by 30 October, and one reported wallet lost 90,695 USDT in a single block. The chain shows how it happened, not who did it, and not how the keys were obtained.

What has been reported

• Starting 9 October, users reported drained wallets on X and Reddit. Reports link the losses to Ledger devices bought through the reseller CryptoBilis in Malaysia, Indonesia and the Philippines.
• According to press reports, Ledger said it is investigating, asked the reseller to pause sales and shipments, found an unauthorized hardware implant in one affected device, and said its own systems and infrastructure were not breached.
• Loss estimates from researchers range from about 72 million to about 103 million US dollars. The highest, from the news site YFarmX, counts 530 addresses on seven chains as of 12 October; its totals rose several times and part of its tracing relies on tooling that has not been published, so we could not verify it. None of the estimates is confirmed by Ledger.
• The mechanism is not confirmed. Researchers have speculated about a hidden module that captures the recovery phrase; others have raised pre-set devices or a reseller data breach.

One wallet, step by step

A Reddit user in r/CryptoScams reported that a Ledger Stax holding almost 100,000 USDT was emptied (the chain shows 90,695 USDT), that the recovery phrase had been handwritten and kept in a safe, and that the device was only ever used to receive funds. We cannot verify those statements. What the chain shows for that wallet (times in UTC):

An approval that is signed by a wallet's own key, followed by a sweep of the leftover fee balance, is what you would see if whoever acted controlled that wallet's private key. The chain cannot tell how they got it: a compromised device, a leaked recovery phrase or something else. The Reddit report does not say where the device was bought, so this wallet is not shown to be connected to CryptoBilis. What does connect it to the wave is the destination: TK6DWNp… is one of the addresses Specter published.

The address that did the pulling

• TAzdU79… was activated on 25 September.
• From 26 September to 7 October it made a handful of tiny test transfers of 2 to 10 dollars, about 56 dollars in total.
• On 9 October it executed 34 pulls from approved wallets, 31.12 million USDT, between 05:07:48 and 14:48:00 UTC, plus one more of 70,000 USDT on 10 October.
• Of everything it ever moved, about 28.98 million USDT went to TK6DWNp….

Who was drained: the wallets behind one pulling address

On 12 October we read all 56 transferFrom calls made by the pulling address TAzdU79…. They took USDT from 55 different wallets, 33 of them with at least 1,000 USDT (the rest are small or test amounts). We leave out the wallet addresses. This pulling address accounts for roughly half of the 65.2 million received by the four collection addresses; we did not analyse the rest.

• Size: the 33 larger wallets lost 31.19 million USDT in total, a median of about 479,000 USDT each. The largest single pull was about 7.0 million.
• Age: 28 of the 33 wallets were created in April 2026 or later. Five are older: three from 2025, one from January and one from March 2026.
• Round sums: nine wallets lost exact round amounts of one million USDT or more (multiples of 10,000). Several were created on the same day: three on 15 April with exactly 1,000,000 each, four on 6 June, two on 13 August. Round sums and same-day creation look more like treasury or operating wallets than like individual savers.
• Other methods: YFarmX reports that other Tron wallets were emptied by changing the account's permissions or by plain signed transfers. Our reading covers only the approval-and-pull path.

What this shows: each of these wallets gave the pulling address an approval signed with its own key, so whoever acted could sign for them. What it does not show: which devices they used, whether they were connected to CryptoBilis, or that all of them belong to the same incident. The mix of recent and older wallets and of small and treasury-sized balances means the group is not simply "individual users of one reseller".

The ten published addresses, as we read them

Tron (USDT)

None of the four sent funds to another of the four, so the total is not double-counted. A received amount is not the same as a victim loss: some senders may be intermediaries.

What Tether has blocked since

On 11 October we read the blacklist of Tether's USDT contract on Tron for the four collection addresses, the pulling address and every address that received USDT directly from the collection addresses (82 distinct addresses).

• TCGE3xp… was added to the blacklist on 9 October at 12:09 UTC, after it had already passed its funds on. The other three collection addresses and the pulling address are not listed.
• 12 of the 82 receiving addresses are on the blacklist, all added since 9 October. Together they hold about 1.0 million USDT, which they can no longer move. That is about 1.5 percent of the 65.2 million received.
• In total, Tether's contract added 57 addresses to its blacklist between 9 and 11 October (48 on 9 October, 9 on 11 October). On 12 October those 57 addresses held about 19.4 million USDT in total (38 of them with a balance). The chain does not show which of them belong to this case.

Bitcoin

On 11 October the first two addresses together held 203.79 BTC that had not been moved. By 3 November both were empty. bc1qjqgwe… was spent in two transactions: on 20 October one paid out 22.0300 and 17.9692 BTC, on 27 October another paid 70.4745 BTC to a single address. bc1qqnkwu… was emptied in one transaction on 30 October, paying 111.2812 BTC to a single address. (Bitcoin transactions can combine coins from several addresses, so the payouts of those transactions are not all from these two addresses.) We did not follow the coins further. The third address received many small amounts and passed all of them on.

Re-read on 3 November: the same 82 receiving addresses (we rebuilt the list from the four collection addresses' outgoing USDT transfers) are still 12 on the blacklist, holding 1,000,001 USDT together, so nothing changed for them. Of the four collection addresses and the pulling address, only TCGE3xp… is listed. Across all cases, Tether's contract has added 389 addresses to its blacklist between 9 October and 3 November (57 of them by 11 October). The chain does not show which of them belong to this case.

Ethereum

At the first reading the three addresses together held about 2,029 ETH. Later on 11 October two of them had been emptied (about 1,000 ETH moved on) and one still held about 1,027 ETH. On 3 November all three held less than 0.0001 ETH on Ethereum; the last activity on them was on 29 and 30 October. Balances on Ethereum can change at any time, so treat them as a snapshot.

The pattern

• Tests first. The pulling address was activated on 25 September and tried itself with small amounts for two weeks. The first collection address was created on 2 October with a small test deposit.
• Fresh addresses on the day. Three of the four Tron collection addresses were created on 9 October, shortly before they received their funds.
• Speed. The first onward transfer from the largest collection address came 19 minutes after the wallet above was emptied, and all four addresses were emptied within hours.
• Waiting on Bitcoin. The two Bitcoin addresses held their 203.79 BTC untouched for at least eleven days and moved it between 20 and 30 October.

What we cannot see

• How the keys were obtained, and whether the victims' devices came from the same seller. The chain does not show it.
• Who controls these addresses. We name no person or company.
• A confirmed total. We did not convert to dollars; senders to the collection addresses may include non-victims.
• Which freezes belong to this case. Tether was reported to have frozen dozens of addresses. We found one collection address and 12 receiving addresses on its blacklist (see above), but funds that had already been moved on to other addresses are not covered, and the chain does not show why Tether blocked a given address.
• Everything after the forwarding: exchanges, swaps or mixers. We did not trace beyond the first hop, including where the Bitcoin and the Ethereum went after they left the published addresses.

If you think you are affected

1. Do not use the device or the recovery phrase again. Move what is left to a new wallet created on a new device from the manufacturer.
2. Save transaction hashes and screenshots, and look for transfers to the addresses above or for an approval you did not make.
3. Report it to Ledger Support and to your local authority. Ignore anyone offering to recover funds for a fee.

Details are in our guide. You can look up Ethereum, Polygon, Arbitrum, Tron and Solana addresses on the home page; Bitcoin addresses need a Bitcoin block explorer. See also unlimited token approvals.

Frequently asked questions

Was Ledger hacked on 9 October 2026?
According to press reports citing Ledger, Ledger's own systems were not breached. Ledger said it found an unauthorized hardware implant in a device belonging to an affected customer and that the reported losses are linked to devices sold through the reseller CryptoBilis in Southeast Asia. The exact mechanism has not been confirmed.

How much was stolen in the Ledger drain?
No figure is confirmed. Researchers have published estimates from about 72 million to about 103 million US dollars; the highest counts 530 addresses on seven chains. In our own reading of ten published addresses, four Tron addresses received about 65.2 million USDT and two Bitcoin addresses that held 203.79 BTC on 11 October had moved all of it by 30 October.

Where did the stolen crypto go?
On Tron, the four addresses we checked forwarded all of their USDT to other addresses within hours, and their balances are now zero. On Bitcoin, two published addresses held 203.79 BTC unspent on 11 October and had moved all of it by 30 October; we did not trace it further. On Ethereum, three published addresses held about 2,029 ETH at our first reading and held almost nothing on 3 November.

Can stolen USDT be frozen?
Tether can blacklist addresses and freeze USDT held there, and it was reported to have frozen dozens of addresses in this case. When we checked on 11 October and again on 3 November, one of the four collection addresses and 12 of the 82 addresses that received USDT directly from them were on its blacklist; the 12 hold about 1.0 million USDT, roughly 1.5 percent of what the four addresses received. A freeze cannot return funds that have already been moved on, and it depends on Tether and on the funds still being at the address.

How do I check whether my wallet was drained by these addresses?
Open your address on a block explorer for its chain and look at the outgoing transfers around 9 October 2026. If funds went to one of the listed collection addresses, or an approval to an unknown spender appears just before, your wallet was part of the same pattern. Report it and move any remaining funds to a new wallet created on a new, verified device.

Found a mistake or have new information? Write to info@hopchain.io and we will correct this page. This is general information, not financial, legal or security advice. We will update this page as the facts change.

More case files and guides

• Ledger CryptoBilis: what is confirmed and what to do
• After a search ad: how an old approval emptied a wallet
• The fake FBI token on Tron
• All case files