Bitquery traced the CryptoBilis drain: $93.2M from 315 wallets on 6 chains in 47 minutes, all via devices from Ledger's reseller in Southeast Asia.
After 41 test runs, the thief took $29M USDT on TRON in 6 seconds on October 9 and emptied 111 Bitcoin wallets in one block. Ledger confirmed "an unauthorized hardware implant" in one victim's device but sees "no indication" its own systems were compromised. Tether froze $10M, while $14.9M was swapped into USDD, which Tether can't freeze.
Ledger's warning covers 90 days of purchases, yet over 80% of victim wallets were first funded from June. Bought from CryptoBilis since then? Move to a new device with a new seed.
