Reports about wallet-draining by Ledger users. Total losses $86M+

[LuckyCrypto777]

Ledger users may have lost over $86 million in a massive cryptocurrency theft.
On-chain analyst Specter reviewed messages from victims on Twitter and Reddit and tracked the attackers' addresses. Transfers were discovered from hundreds of wallets across several major networks, including Bitcoin, Ethereum, and TRON.
The cause of the theft is still unknown. There is no confirmation that the Ledger devices themselves were hacked.

https://x.com/SpecterAnalyst/status/2108534068564373687


From X tanuki42:

If you were just drained to any of the following addresses, please can you reach out to @SEAL_911 asap. Total loss is >$72M+ and increasing

TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C
TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9
TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW
TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a
bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl
0x83aeac166f6832ae3500000a24510a95a052a599
0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a
0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841

https://x.com/tanuki42_/status/2108527923766399243

It's important to mention that the seed phrase of the affected wallets has most likely been compromised, and anyone using a Ledger wallet should create a new seed phrase on another device, and move their funds to those fresh addresses.  

[OmegaStarScream]

Some users in the comments[1] are reporting receiving phishing emails. This would explain this[1] (a smart contract interaction). Although OP seem to be denying signing anything.

Not a fan of Ledger, but some of the other posts on the subreddit are not really showing or explaining anything. Difficult to take seriously.

[1] https://x.com/coinbureau/status/2108540501913952705
[2] https://www.reddit.com/r/ledgerwallet/comments/1x1fz09/comment/pet9lb5/

[julerz12]

Eh? WTH, that's crazy and scary at the same time.
I searched on Reddit, and I found some guy's post; his $100k worth of USDT got drained, and it started when he blindly signed a transaction on the TRON network - surprise, surprise, that transaction allows an unlimited trade of USDT. 

[crwth]

It's freaking really scary now. Like when I try to open my Ledger Wallet, it gives me anxiety reading this thread.

Isn't there hackers/scmammers that distribute fake ledger live? I'm really paranoid into this types of things and there might be some updates that are not updated to real time. You're going to be safe if you just don't put your recovery phrase right?

There's also a part where you accept wallet management or something. Maybe revoking those that were previously approved in your wallet to make sure you are safe with it.

[NABiT]

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis...https://x.com/Ledger_Support/status/2108551100613714002?s=20

[Zaguru12]

Not a fan of Ledger, but some of the other posts on the subreddit are not really showing or explaining anything. Difficult to take seriously.

It’s still unclear which type of scam was used but Ledger has actually issued an announcement [1] that victims are those who purchased their ledger wallet from a third party reseller named CryptoBills and are warning those who got their wallet from the reseller most importantly those in South East Asia to move their coins to a new device and wallet (seed and phrase)

Also there is report that the exploit was carried out through phishing email with the some reporting that the email looks like the in the image [1].

[1] https://x.com/ledger_support/status/2108551100613714002?s=46&t=QdZ3_ryvESgybupE3D6xaQ

Image [1]

If both claims are true then there is two lessons here

1. Don’t buy your hardware wallet from resellers or other third party sources

2. Don’t rush to update your wallet when you get a message, wait to verify such information first.

[BlackHatCoiner]

Ledger is closed-source and therefore we do not know whether this is a confirmed vulnerability yet, or the fault of the reseller. Either way, it's a WARNING to all Ledger users to move their coins off of their Ledger, because "your reseller" might be the next.

Maybe there is no vulnerability. MAYBE. We don't know for sure. If you don't want to learn this lesson the hard way, consider your wisest choice.

[LuckyCrypto777]

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis...https://x.com/Ledger_Support/status/2108551100613714002?s=20

Apparently this statement and this 86m drain are connected. Such a coincidence is impossible.

[PostQuantumBTC]

It’s still unclear which type of scam was used but Ledger has actually issued an announcement [1] that victims are those who purchased their ledger wallet from a third party reseller named CryptoBills and are warning those who got their wallet from the reseller most importantly those in South East Asia to move their coins to a new device and wallet (seed and phrase)

This is another very good reason to be using wallet on an airgapped device. One other thing is that did you know that Ledger is a close source wallet? Nobody can know if it is Ledger that is stealing their customers cryptocurrencies. I can not trust a wallet that I do not know how its seed phrase is generated.

[OmegaStarScream]

I'm not sure who's behind this SEAL 911 initiative but Ledger just reposted this from their official account:

https://x.com/tanuki42_/status/2108527923766399243

@LuckyCrypto777 it might be worth to include this (or at least the addresses) in the OP, in case there is someone from here who was affected by this.

[Ruttoshi]

This is another very good reason to be using wallet on an airgapped device. One other thing is that did you know that Ledger is a close source wallet? Nobody can know if it is Ledger that is stealing their customers cryptocurrencies. I can not trust a wallet that I do not know how its seed phrase is generated.

In the first place, Ledger is a closed source wallet and people should have stopped using this wallet a long time ago. Third party is either one way or the order adding more insecurities to these hardware wallets with the way they handle it. Since, this is only for victims in South East Asia, does it mean that ledger users from other regions are safe from this.

Anyone here still using ledger should throw it into the river and advice anyone you know that's also using it because they're always targets to scammers and also vulnerable to scammers.

[Lucius]

Ledger users may have lost over $86 million in a massive cryptocurrency theft.
~snip~

Do all these users live in some parallel universe where there are no warnings that have been coming for years when it comes to Ledger devices? A person who has $100k worth of cryptocurrency and does not understand what risk he is exposed to by using Ledger was actually asking for something bad to happen to him.

[Zaguru12]

Maybe there is no vulnerability. MAYBE. We don't know for sure. If you don't want to learn this lesson the hard way, consider your wisest choice.

I think someone that has lost $100k has actually learned the hard way. Someone with amount still using ledger is actually not someone that will heed to advice.

I think from the ledger announcement which says others within the region or those that bought from the reseller to move their coins to another wallet and another ledger wallet is enough advice already,

Although my own advice for the 100th times  will be move away from ledger wallet and avoid any seed phrase generated with the wallet

[stompix]

So, people bought a ledger from a reseller...
Said reseller claims 35 000 products sold but makes photos with Lamborghinis, I wonder what profit margin they would have on a $100 product ?
Must be a pretty productive trade...

Anyone here still using ledger should throw it into the river .

You know littering is carrying quite a hefty fine here, and besides, what did the fish ever do to you?

That aside...
It has never been easier to be your own bank with crypto! Never!

[Odohu]

If the attack remains within South East Asia and from the reseller CryptoBills, then it narrow everything down to them and this may be a case of their staff tampering with the wallet. These attacks scare me to death because those maybe be the entire saving of some people being drained. Last time it was open source wallet,  today it is a closed source wallet, what then is the way forward?

[LuckyCrypto777]

Former Mt. Gox CEO Mark Karpelès believes the cause may be a malicious implant. A physical cause.

This looks like this could be exactly what I'm investigating. Anyone affected, please contact me or open your ledger and send me pictures so we can confirm if there's a bug in there (pictures: ledger board on top, spy implant below).

https://x.com/MagicalTux/status/2108556423445835827

[DireWolfM14]

~

It's important to mention that the seed phrase of the affected wallets has most likely been compromised, and anyone using a Ledger wallet should create a new seed phrase on another device, and move their funds to those fresh addresses.  Please place this warning in the OP.

Regardless of the source of the hack, weather it was caused by tampering by the reseller or a resulting from a malicious firmware update, it's safe to assume the seed phrase is compromised.

[greysonz]

Former Mt. Gox CEO Mark Karpelès believes the cause may be a malicious implant. A physical cause.

This looks like this could be exactly what I'm investigating. Anyone affected, please contact me or open your ledger and send me pictures so we can confirm if there's a bug in there (pictures: ledger board on top, spy implant below).

https://x.com/MagicalTux/status/2108556423445835827

He must be right, because social media users are posting screenshots like these. Devices are different.

[OmegaStarScream]

https://x.com/MistTrack_io/status/2108577166351016179

According to MistTrack, Tether has already started action by blacklisting some of the addresses linked to this incident.

Sadly though, even with some of the funds frozen, if the seedphrases were comrpomised, it would still be difficult to return the funds to their rightful owners, and even if doable, it's probably not going to be for everyone.

[Hypnotizer]

Former Mt. Gox CEO Mark Karpelès believes the cause may be a malicious implant. A physical cause.

This looks like this could be exactly what I'm investigating. Anyone affected, please contact me or open your ledger and send me pictures so we can confirm if there's a bug in there (pictures: ledger board on top, spy implant below).

https://x.com/MagicalTux/status/2108556423445835827

He posted about this kinda malicious implant in Ledger hardware wallets yesterday I think and surprisingly there’s this attack today and it’s looking like this might be the very cause since it is suspected that the funds are being stolen from people that bought the hardware from a Reseller. So this might probably be the case for some of the stolen funds here.

https://x.com/magicaltux/status/2108095743525625998?s=46

Nevertheless anyone who want to buy a hardware wallet can do better, Ledger should never be an option, their customers have suffered a lot of losses over the years.


Edit:
Someone lost $5.2m in this theft after he deposited all of his 80BTC in a ledger wallet he bought from this same reseller in question just one week ago. This is really sad.

I wonder why people are still buying ledger wallets to store their coins at this point in time with all the big crypto theft and hacks that happened this year.

https://x.com/lookonchain/status/2108585005635301427?s=46