🚨 $87 Million Ledger User Theft Cluster Exposed on Arkham

This is not a small exploit.
This is one of the most significant hardware-wallet related drains in recent memory.
Arkham Intelligence has labeled a massive cluster under “ledger user theft” currently holding approximately $86.96 million across 98 addresses.
Here’s the breakdown of what’s sitting in these wallets right now:
16,843 ETH → $42.15 million
211.199 BTC → $17.56 million
16.5 million USDT → $16.5 million
10.523 million USDD → $10.52 million
Smaller holdings in TRX, USDC, and BNB
The primary funding trail on Tron points to the address:
TLsBWQidHcE97HtmsHfMVhSzFgud3bxKPu
What Happened
On-chain investigators, led by Specter, traced inflows from hundreds of victim wallets across Ethereum, Bitcoin, and Tron. Total suspected losses exceed $86 million, with some trackers putting the figure even higher.
Ledger has officially confirmed it is investigating reports of drained funds from users in Southeast Asia who purchased devices through a reseller named CryptoBilis. As a precaution, Ledger has:
Asked CryptoBilis to immediately pause all sales and shipments
Advised anyone who bought from this reseller in the past 90 days not to set up the device if they haven’t already
Recommended that those who already activated their devices move funds to a new seed phrase on a fresh device
The leading theory is a supply-chain attack — possibly tampered hardware wallets sold through the reseller that allowed the attacker to extract or pre-know seed phrases.
Why This Matters
Hardware wallets are supposed to be the final layer of security. When that layer is compromised at the distribution stage, even the most careful users can get drained without ever signing a malicious transaction.
This incident is a brutal reminder:
Never buy hardware wallets from unauthorized or third-party resellers
Always buy directly from the official manufacturer
Verify packaging, seals, and firmware on first setup
Treat any unexpected “empty wallet” reports seriously and move funds immediately
Tether has already begun freezing linked USDT in some of the associated addresses, but a large portion of the funds (especially USDD and already-moved assets) remains at risk.
The cluster is still being monitored in real time. Funds continue to move. The investigation is ongoing.
Stay vigilant.
Verify every device.
Never compromise on where you source your hardware.
This is a hard lesson for the entire industry.
What are your thoughts on supply-chain risks in hardware wallets? Drop them below.
#LedgerLossesNear90Million