CryptoBilis-Linked Wallet Drains Hit $93.2M as $10M Frozen, Bitquery Says
Blockchain analytics company Bitquery revealed that an estimated $93.2 million in digital assets was systematically drained from Ledger hardware wallets purchased through authorized regional reseller CryptoBilis, with stablecoin issuer Tether freezing approximately $10 million linked to the incident, according to a report by Pasquale Pillitteri. The extensive CryptoBilis-linked wallet drains took place between Friday, October 9 and Saturday, October 10, 2026, hitting device owners across six separate blockchain ecosystems.
The thefts followed hardware security discoveries confirmed by Ledger on October 10, 2026, which revealed that an unauthorized hardware implant was detected inside a unit belonging to an impacted customer. The targeted hardware wallets had been distributed to users across Southeast Asia, primarily within Indonesia, Malaysia and the Philippines, where CryptoBilis operated as a certified distributor, Pasquale Pillitteri reported.
According to reporting from Pasquale Pillitteri, the sudden siphoning of capital represents one of the largest hardware supply compromises documented in digital asset history. Ledger confirmed the presence of the rogue physical component after inspecting the customer device, verifying an unauthorized hardware implant had been inserted inside the equipment.
Tether Freezes $10M as Funds Move Across Blockchains
Recovery efforts began minutes after public alerts appeared, according to tracking records from Bitquery. Tether initiated asset blacklisting actions around ten minutes after 12:09 UTC, which was when the first public alert surfaced. By 14:10 UTC, the stablecoin issuer had restricted a total of 37 addresses, twenty of which collectively contained about $10 million in USDT, according to Pasquale Pillitteri.
Despite these swift freezes, a large portion of the stolen funds remains exposed to laundering techniques, with Bitquery calculating that the easily traceable share of capital dropped from around $88 million on Saturday morning to approximately $81 million by Sunday morning. The firm noted that the attacker may have transferred additional balances as laundering continued, Pasquale Pillitteri reported.
Bitquery noted that while stablecoin issuers intervened to blacklist certain addresses, the bulk of the extracted capital was pushed through non-freezable assets and decentralized mixing protocols. As transactions propagated, the analytical firm estimated that approximately $81 million remained traceable on public ledgers, an amount diminishing with every outbound hop organized by the thief, Pasquale Pillitteri reported.
Scale of the CryptoBilis-Linked Wallet Drains
Bitquery revised its forensic assessment of the total damage upward over the weekend as more on-chain destinations were uncovered. The analytics platform originally reported that $92.9 million had been taken from 311 unique addresses spread across five networks. Following further investigation, Bitquery updated its count to $93.2 million stolen across 315 wallets over six separate blockchains, Pasquale Pillitteri reported.
The scope of the CryptoBilis-linked wallet drains underscores a calculated execution across multiple ledgers. The coordinated theft targeted users across several countries who relied on products obtained from the same distribution partner, according to Pasquale Pillitteri.
The siphoning of balances was finalized over a narrow operational window between Friday, October 9 and Saturday, October 10, 2026. Data published by Bitquery revealed that the entire sum of about $93.2 million was stripped across the six affected blockchain networks, striking victims who had procured their hardware storage through CryptoBilis, according to Pasquale Pillitteri.
Bitquery Details Extensive Preparatory Probes
On-chain evidence assembled by Bitquery suggests the perpetrators conducted operational testing well before initiating the mass drain. Analysts identified 41 low-value trial cycles conducted between September 26 and October 7, comprising 21 sequences executed on the Tron network and 20 on Ethereum, according to Pasquale Pillitteri.
Each of these rehearsal transfers followed an identical operational pattern, involving a few dollars transferred into a target wallet, an approval transaction being granted, and the assets subsequently returned, Bitquery observed in Pasquale Pillitteri's reporting. These test routines indicate deliberate coordination leading up to the final CryptoBilis-linked wallet drains.
These exploratory cycles took place over nearly two weeks leading directly up to the weekend heist. Bitquery tracked 21 trial sequences on Tron and 20 separate trials across Ethereum between September 26 and October 7, showing that the entity behind the exploit repeatedly tested wallet approvals and fund reversals before executing the wider draining sequence, Pasquale Pillitteri reported.
Hardware Implant Discovered in Affected Ledger Device
Hardware verification performed by Ledger verified that physical tampering had occurred on at least one retail unit. On October 10, 2026, the device manufacturer confirmed finding an unauthorized secondary component installed within the equipment of an impacted client, according to Pasquale Pillitteri.
While roughly $93.2 million vanished from customer balances associated with hardware distributed by CryptoBilis across Indonesia, Malaysia and the Philippines, investigations continue into the full distribution of tampered products, Pasquale Pillitteri reported. The presence of the implant aligns chronologically with the widespread CryptoBilis-linked wallet drains identified on-chain.
The discovery confirmed by Ledger on October 10 verified that the physical unit inspected from an impacted user contained an unauthorized hardware implant. Customers in Indonesia, Malaysia, and the Philippines who bought hardware units through CryptoBilis represent the primary group suffering from the nearly $93.2 million in drained balances, Pasquale Pillitteri reported.
Conclusion
Forensic findings from Bitquery establish that $93.2 million was stolen across 315 wallets on six blockchains following the compromise of devices bought through CryptoBilis, with roughly $81 million remaining traceable as laundered balances shift. Tether has frozen around $10 million in USDT across 20 targeted addresses, though additional capital remains in motion following prior preparatory test runs between September 26 and October 7.
Frequently Asked Questions
How much was stolen in the CryptoBilis-linked wallet drains?
According to on-chain analytics firm Bitquery, approximately $93.2 million was drained across 315 cryptocurrency wallets spanning six distinct blockchains between Friday, October 9 and Saturday, October 10, 2026.
How much money has been frozen in connection with the theft?
Tether acted within minutes of the initial public report on October 10, blacklisting 37 addresses by 14:10 UTC. Twenty of those blacklisted wallets contained roughly $10 million in USDT, which remains frozen.
What did Ledger confirm regarding the CryptoBilis devices on October 10, 2026?
Ledger confirmed on October 10, 2026 that an unauthorized hardware implant was detected inside the physical device of an affected customer who had purchased their unit through regional reseller CryptoBilis.
Did Bitquery find evidence of advance planning before the October drains?
Yes. Bitquery discovered 41 trial cycles between September 26 and October 7, 2026, split across Tron (21 tests) and Ethereum (20 tests), where small sums were deposited, approved and returned.