{ "version": 1, "event_id": "evt_c594d0e29e7b400b", "url": "https://xiyu.news/events/evt_c594d0e29e7b400b/", "json": "https://xiyu.news/api/events/evt_c594d0e29e7b400b.json", "type": "security_incident", "status": "monitoring", "category": "crypto", "title": { "zh": "Ledger 授权经销商渠道遭攻击，数百用户钱包被盗约 8600 万美元", "en": "【Specter：数百个 Ledger 用户钱包疑似被盗，损失超 8600 万美元】" }, "current_state": { "zh": "Ledger 正在调查与东南亚授权经销商 CryptoBilis 相关的用户资金损失事件；Ledger 已要求 CryptoBilis 暂停销售和发货，并对过去90天内购买设备的客户发出警示。链上研究人员估计相关损失约为7200万至9000万美元，Tether 已冻结相关 USDT。赵长鹏等业内人士公开评论并呼吁行业协助追踪资金，Mark Karpelès 正调查设备是否植入恶意硬件组件，但攻击方式、设备是否被篡改及攻击者身份仍未确认，调查仍在进行中。", "en": "Ledger is investigating reported fund losses tied to Southeast Asian authorized reseller CryptoBilis; Ledger has asked CryptoBilis to suspend sales and shipments and warned customers who bought devices in the past 90 days. Onchain researchers estimate losses at roughly $72 million to $90 million, and Tether has frozen related USDT. Industry figures including Changpeng Zhao have publicly commented and called for industry help tracing funds, while Mark Karpelès is investigating whether malicious hardware components were implanted; the attack method, device tampering and attacker identity remain unconfirmed, and the investigation is ongoing." }, "first_seen_at": "2026-10-09T15:30:47.822838+00:00", "last_updated_at": "2026-10-09T22:30:50.383722+00:00", "last_material_change_at": "2026-10-09T22:30:50.383722+00:00", "confidence": 0.75, "updates_count": 10, "sources_count": 25, "entities": [ "after", "asia", "asian", "binance", "cash", "ceo", "cryptobilis", "cryptobillis", "draining", "founder", "gox", "hack", "hardware", "investigates", "largest", "ledger", "lte", "maker", "many", "million", "quarantine", "report", "reseller", "southeast", "southeast-asia", "specter", "tether", "tornado", "tornado-cash", "urges", "usdt", "wallet", "world" ], "identifiers": [], "topics": [ "asset-theft", "crypto-theft", "fund-losses", "fund-theft", "fund-tracing", "hacks-exploits", "ledger", "on-chain-analysis", "security-breach", "security-incident", "self-custody", "southeast-asia", "supply-chain", "supply-chain-attack", "tether", "tether-freeze", "theft", "tornado-cash", "usdt-freeze", "wallet-security" ], "updates": [ { "update_id": "upd_957c41b0f311ca8b", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T12:28:02Z", "published_at": "2026-10-09T12:28:02Z", "first_seen_at": "2026-10-09T15:30:47.822838Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "【Specter：数百个 Ledger 用户钱包疑似被盗，损失超 8600 万美元】", "title_en": "【Specter：数百个 Ledger 用户钱包疑似被盗，损失超 8600 万美元】", "what_changed_zh": "链上分析师Specter报告称，数百名Ledger用户的钱包在以太坊、TRON和比特币上被盗空，已追踪的被盗资金超过8600万美元。", "what_changed_en": "Chain analyst Specter reports that hundreds of Ledger users have had wallets drained across Ethereum, TRON and Bitcoin, with traced stolen funds exceeding $86 million.", "current_state_zh": "链上分析师Specter报告称，数百名Ledger用户的钱包在以太坊、TRON和比特币上被盗空，已追踪的被盗资金超过8600万美元。", "current_state_en": "Chain analyst Specter reports that hundreds of Ledger users have had wallets drained across Ethereum, TRON and Bitcoin, with traced stolen funds exceeding $86 million.", "detailed_summary_zh": "Chain analyst Specter reports that hundreds of Ledger users have had wallets drained across Ethereum, TRON and Bitcoin, with traced stolen funds exceeding $86 million.", "detailed_summary_en": "Chain analyst Specter reports that hundreds of Ledger users have had wallets drained across Ethereum, TRON and Bitcoin, with traced stolen funds exceeding $86 million.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120050", "telegram:theblockbeats:199711", "rss:www.theblock.co_rss.xml:26f3cdd1777d905d", "rss:cointelegraph.com_rss:6368221780010688", "google_news:article:b949392d4e1fa6fe" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114863", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/371031?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163", "label": "The Block", "source_type": "rss", "official": false }, { "url": "https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://u.today/binance-founder-cz-urges-wallet-quarantine-after-86-million-ledger-reseller-hack?amp", "label": "U.Today", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_4cfb1aa869db284c", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T13:47:05Z", "published_at": "2026-10-09T13:47:05Z", "first_seen_at": "2026-10-09T15:30:47.825240Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "【Ledger：正调查东南亚用户资金损失报告，涉事设备购自经销商 CryptoBilis】", "title_en": "【Ledger：正调查东南亚用户资金损失报告，涉事设备购自经销商 CryptoBilis】", "what_changed_zh": "Ledger正在调查东南亚用户通过经销商CryptoBilis购买的设备资金失窃的报告，已要求该经销商暂停销售和发货，并建议受影响用户放弃90天购买窗口内的设备，或将资产迁移到使用全新助记词的新设备，链上分析师估计有7200万至8600万美元以上从数百个比特币、以太坊和TRON钱包中被盗走。", "what_changed_en": "Ledger is investigating reports of Southeast Asian users losing funds from devices bought via reseller CryptoBilis, has told the reseller to pause sales and shipping, and advises affected users to abandon a 90-day purchase window or migrate assets to a new device with a fresh seed phrase, as on-chain analysts estimate $72M–$86M+ drained from hundreds of Bitcoin, Ethereum and TRON wallets.", "current_state_zh": "Ledger正在调查东南亚用户通过经销商CryptoBilis购买的设备资金失窃的报告，已要求该经销商暂停销售和发货，并建议受影响用户放弃90天购买窗口内的设备，或将资产迁移到使用全新助记词的新设备，链上分析师估计有7200万至8600万美元以上从数百个比特币、以太坊和TRON钱包中被盗走。", "current_state_en": "Ledger is investigating reports of Southeast Asian users losing funds from devices bought via reseller CryptoBilis, has told the reseller to pause sales and shipping, and advises affected users to abandon a 90-day purchase window or migrate assets to a new device with a fresh seed phrase, as on-chain analysts estimate $72M–$86M+ drained from hundreds of Bitcoin, Ethereum and TRON wallets.", "detailed_summary_zh": "Ledger is investigating reports of Southeast Asian users losing funds from devices bought via reseller CryptoBilis, has told the reseller to pause sales and shipping, and advises affected users to abandon a 90-day purchase window or migrate assets to a new device with a fresh seed phrase, as on-chain analysts estimate $72M–$86M+ drained from hundreds of Bitcoin, Ethereum and TRON wallets.", "detailed_summary_en": "Ledger is investigating reports of Southeast Asian users losing funds from devices bought via reseller CryptoBilis, has told the reseller to pause sales and shipping, and advises affected users to abandon a 90-day purchase window or migrate assets to a new device with a fresh seed phrase, as on-chain analysts estimate $72M–$86M+ drained from hundreds of Bitcoin, Ethereum and TRON wallets.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120059", "google_news:article:8d92198eb6731338", "rss:www.coindesk.com_arc_outboundfeeds_rss_:7d9e10556fc49745", "telegram:theblockbeats:199729", "rss:thedefiant.io_api_feed:83013e60c7a4c059", "telegram:wublockchainenglish:26349", "rss:decrypt.co_feed:fe41f2c338b44da9" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114872", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://bitpinas.com/business/ledger-cryptobilis/", "label": "BitPinas", "source_type": "google_news", "official": false }, { "url": "https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://m.theblockbeats.info/flash/371049?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://thedefiant.io/news/hacks/ledger-asks-cryptobilis-to-halt-sales-amid-reports-of-lost-funds", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://wublockchain.xyz/news/news-21176", "label": "wublockchainenglish", "source_type": "telegram", "official": false }, { "url": "https://decrypt.co/380582/ledger-probes-87m-theft-crypto-wallet-reseller", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_e4d5e427fda7b7b2", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T14:05:02Z", "published_at": "2026-10-09T14:05:02Z", "first_seen_at": "2026-10-09T15:30:48.094719Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "⚡️CZ警告Ledger硬件钱包供应链攻击风险，疑似单一经销商出售假冒或遭篡改设备", "title_en": "⚡️CZ警告Ledger硬件钱包供应链攻击风险，疑似单一经销商出售假冒或遭篡改设备", "what_changed_zh": "CZ公开警告Ledger硬件钱包用户注意供应链攻击风险，称事件疑似局限于一家经销商（CryptoBilis）出售假冒或遭篡改设备，并呼吁BNB生态及加密行业协助追踪被盗资金。", "what_changed_en": "CZ publicly warned Ledger hardware wallet users about supply-chain attack risk, saying the incident appears limited to one reseller (CryptoBilis) selling counterfeit or tampered devices, and called on BNB ecosystem and crypto industry to help track stolen funds.", "current_state_zh": "Ledger正调查东南亚用户通过CryptoBilis购买设备后资金被盗事件，已要求该经销商暂停销售和发货；CZ公开警告供应链攻击风险并呼吁行业协助追踪被盗资金；链上估计损失超过8600万美元。", "current_state_en": "Ledger is investigating the theft of funds from Southeast Asian users who bought devices via CryptoBilis, has told the reseller to pause sales and shipping; CZ publicly warned of supply-chain attack risk and called for industry help tracking stolen funds; on-chain estimates exceed $86M.", "detailed_summary_zh": "CZ warned Ledger users about a supply-chain attack in which a single reseller (CryptoBilis) apparently sold counterfeit or tampered devices, amid a Ledger investigation into Southeast Asian users' stolen assets and on-chain estimates of over $86 million losses across hundreds of Bitcoin, Ethereum and Tron wallets.", "detailed_summary_en": "CZ warned Ledger users about a supply-chain attack in which a single reseller (CryptoBilis) apparently sold counterfeit or tampered devices, amid a Ledger investigation into Southeast Asian users' stolen assets and on-chain estimates of over $86 million losses across hundreds of Bitcoin, Ethereum and Tron wallets.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.9, "story_ids": [ "telegram:theblockbeats:199737" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371057?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_a1ad1970d1cb1998", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T15:22:02Z", "published_at": "2026-10-09T15:22:02Z", "first_seen_at": "2026-10-09T15:30:48.099074Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "⚡️Ledger安全事件损失接近9000万美元，Tether正冻结涉事地址中的大量USDT", "title_en": "⚡️Ledger安全事件损失接近9000万美元，Tether正冻结涉事地址中的大量USDT", "what_changed_zh": "一起与Ledger相关的安全事件造成近9000万美元损失，MistTrack正在追踪这些资金，Tether已冻结与此次事件相关地址中的大量USDT。", "what_changed_en": "A Ledger-related security incident has caused losses approaching $90 million, with MistTrack tracking the funds and Tether freezing substantial USDT in addresses tied to the event.", "current_state_zh": "一起与Ledger相关的安全事件造成近9000万美元损失，MistTrack正在追踪这些资金，Tether已冻结与此次事件相关地址中的大量USDT。", "current_state_en": "A Ledger-related security incident has caused losses approaching $90 million, with MistTrack tracking the funds and Tether freezing substantial USDT in addresses tied to the event.", "detailed_summary_zh": "A Ledger-related security incident has caused losses approaching $90 million, with MistTrack tracking the funds and Tether freezing substantial USDT in addresses tied to the event.", "detailed_summary_en": "A Ledger-related security incident has caused losses approaching $90 million, with MistTrack tracking the funds and Tether freezing substantial USDT in addresses tied to the event.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:199750", "telegram:foresightnews:120066", "rss:thedefiant.io_api_feed:cdfb2c223025d673", "telegram:theblockbeats:199754" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371070?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/114879", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://thedefiant.io/news/hacks/tether-freezes-usdt-linked-to-ledger-user-thefts-misttrack-says", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "http://ledger.com/", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_7b3809f6e263a250", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T15:34:19Z", "published_at": "2026-10-09T15:34:19Z", "first_seen_at": "2026-10-09T18:27:25.800543Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "许多从经销商 CryptoBillis 购买设备的 #Ledger 用户已经", "title_en": "Many #Ledger users who bought their devices from reseller CryptoBillis have had", "what_changed_zh": "Lookonchain 报告称，一名用户（地址 TY24Ya）三周前从经销商 CryptoBilis 购买 Ledger 设备并存入 700 万 USDT，约 10 小时前全部被盗，可能是此次事件中最大单笔损失。", "what_changed_en": "Lookonchain reports that one user (address TY24Ya) bought a Ledger device from reseller CryptoBilis three weeks ago and deposited 7M USDT, all of which was stolen about 10 hours before the report, possibly the largest single loss in the incident.", "current_state_zh": "与 Ledger 相关的供应链攻击事件确认损失近 9000 万美元，MistTrack 正在追踪资金，Tether 已冻结相关地址中的大量 USDT，并新增一名被盗 700 万 USDT 的可能最大受害者。", "current_state_en": "The Ledger-related supply-chain attack has confirmed losses approaching $90 million, with MistTrack tracking funds, Tether freezing substantial USDT in related addresses, and a new possible largest victim losing 7M USDT.", "detailed_summary_zh": "Users who purchased Ledger hardware wallets from reseller CryptoBillis have reportedly had funds drained, with total losses approaching $90M, including one victim who lost 7M USDT about 10 hours before the report.", "detailed_summary_en": "Users who purchased Ledger hardware wallets from reseller CryptoBillis have reportedly had funds drained, with total losses approaching $90M, including one victim who lost 7M USDT about 10 hours before the report.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.95, "story_ids": [ "telegram:lookonchainchannel:10562", "telegram:theblockbeats:199753" ], "sources": [ { "url": "https://arkm.com/explorer/address/TY24Ya7z1zHn4Br38SgwSxdvcbD9syWg6D", "label": "lookonchainchannel", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/371073?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_e6442c6a6ffae573", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T16:02:02Z", "published_at": "2026-10-09T16:02:02Z", "first_seen_at": "2026-10-09T18:27:27.032374Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "🔍 链上侦探 | 某用户6月抄底80枚BTC浮盈138万美元，一周前存入Ledger现已全部被盗", "title_en": "🔍 链上侦探 | 某用户6月抄底80枚BTC浮盈138万美元，一周前存入Ledger现已全部被盗", "what_changed_zh": "Lookonchain 报告另一名受害者：约四个月前以约 520 万美元买入 80 枚 BTC，一周前从经销商 CryptoBilis 购买 Ledger 硬件钱包并将全部 BTC 转入，现已被全部盗走；该案被与 CryptoBilis 客户资金被盗事件关联，但设备是否遭篡改、攻击方式和攻击者身份仍未证实。", "what_changed_en": "Lookonchain reports another victim: a user bought 80 BTC about four months earlier for ~$5.2M, moved all BTC into a Ledger hardware wallet bought a week earlier from reseller CryptoBilis, and the entire balance was stolen; the case is linked to other CryptoBilis customer drains, though device tampering, attack method and attacker identity remain unconfirmed.", "current_state_zh": "与 Ledger 相关的供应链攻击事件确认损失近 9000 万美元，MistTrack 正在追踪资金，Tether 已冻结相关地址中的大量 USDT，并新增一名被盗 700 万 USDT 的可能最大受害者；最新报告又确认一名从 CryptoBilis 购买 Ledger 并转入 80 枚 BTC 的受害者资金被盗，设备篡改与攻击者身份仍未证实。", "current_state_en": "The Ledger-related supply-chain attack has confirmed losses approaching $90 million, with MistTrack tracking funds, Tether freezing substantial USDT in related addresses, and a new possible largest victim losing 7M USDT; the latest report adds another victim who bought a Ledger from CryptoBilis and had 80 BTC drained, while device tampering and attacker identity remain unconfirmed.", "detailed_summary_zh": "A user who moved 80 BTC (~$5.2M cost basis, ~$1.38M paper profit) into a Ledger hardware wallet bought a week earlier from reseller CryptoBillis has had the entire balance stolen, with Lookonchain linking the case to other CryptoBillis customers whose funds were also drained.", "detailed_summary_en": "A user who moved 80 BTC (~$5.2M cost basis, ~$1.38M paper profit) into a Ledger hardware wallet bought a week earlier from reseller CryptoBillis has had the entire balance stolen, with Lookonchain linking the case to other CryptoBillis customers whose funds were also drained.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.96, "story_ids": [ "telegram:theblockbeats:199756", "telegram:lookonchainchannel:10564" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371076?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://arkm.com/explorer/address/bc1q9r0jxknrtlc96dankvgkwa0347569rc6dn53fs", "label": "lookonchainchannel", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_3c47b16f0e93d4b8", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T16:10:02Z", "published_at": "2026-10-09T16:10:02Z", "first_seen_at": "2026-10-09T18:27:27.032555Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Mt.Gox前CEO称发现被植入间谍模块的Ledger硬件钱包，可通过LTE发送助记词信息", "title_en": "Mt.Gox前CEO称发现被植入间谍模块的Ledger硬件钱包，可通过LTE发送助记词信息", "what_changed_zh": "Mt. Gox 前 CEO Mark Karpelès 披露，他从马来西亚收到的一台 Ledger 硬件钱包内含隐藏间谍模块，配备 LTE、天线、eSIM 以及连接到设备 SPI 总线的微控制器，能够捕获显示的字符并在设置后窃取助记词，并敦促用户遵循 Ledger 的官方设备验证指引。", "what_changed_en": "Mt. Gox ex-CEO Mark Karpelès disclosed that a Ledger hardware wallet he received from Malaysia contained a hidden spy module with LTE, antenna, eSIM and a microcontroller wired to the device's SPI bus, capable of capturing displayed characters and exfiltrating seed phrases after setup, and urged users to follow Ledger's official device-verification guidance.", "current_state_zh": "Mt. Gox 前 CEO Mark Karpelès 披露，他从马来西亚收到的一台 Ledger 硬件钱包内含隐藏间谍模块，配备 LTE、天线、eSIM 以及连接到设备 SPI 总线的微控制器，能够捕获显示的字符并在设置后窃取助记词，并敦促用户遵循 Ledger 的官方设备验证指引。", "current_state_en": "Mt. Gox ex-CEO Mark Karpelès disclosed that a Ledger hardware wallet he received from Malaysia contained a hidden spy module with LTE, antenna, eSIM and a microcontroller wired to the device's SPI bus, capable of capturing displayed characters and exfiltrating seed phrases after setup, and urged users to follow Ledger's official device-verification guidance.", "detailed_summary_zh": "Mt. Gox ex-CEO Mark Karpelès disclosed that a Ledger hardware wallet he received from Malaysia contained a hidden spy module with LTE, antenna, eSIM and a microcontroller wired to the device's SPI bus, capable of capturing displayed characters and exfiltrating seed phrases after setup, and urged users to follow Ledger's official device-verification guidance.", "detailed_summary_en": "Mt. Gox ex-CEO Mark Karpelès disclosed that a Ledger hardware wallet he received from Malaysia contained a hidden spy module with LTE, antenna, eSIM and a microcontroller wired to the device's SPI bus, capable of capturing displayed characters and exfiltrating seed phrases after setup, and urged users to follow Ledger's official device-verification guidance.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:199757" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371077?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_5c9d7389e1a2ec22", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T16:31:02Z", "published_at": "2026-10-09T16:31:02Z", "first_seen_at": "2026-10-09T18:27:27.032951Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "⚡️Ledger盗币黑客向Tornado Cash转入107万美元ETH，部分资金流入Binance热钱包", "title_en": "⚡️Ledger盗币黑客向Tornado Cash转入107万美元ETH，部分资金流入Binance热钱包", "what_changed_zh": "嫌疑人通过 4 个钱包向 Tornado Cash 转入 430.2 ETH（约 107 万美元），并在 Tether 冻结后通过 SUN.io 及 USDD PSM 将 USDT 兑换为 USDD，部分资金流入 Binance 热钱包；相关钱包仍持有约 7060 万美元资产。", "what_changed_en": "Suspects moved 430.2 ETH (~$1.07M) to Tornado Cash via 4 wallets, and after Tether's freeze converted USDT to USDD via SUN.io and the USDD PSM, with some funds routed to a Binance hot wallet; suspect wallets still hold ~$70.6M.", "current_state_zh": "与 Ledger 相关的供应链攻击事件确认损失近 9000 万美元，MistTrack 正在追踪资金，Tether 已冻结相关地址中的大量 USDT；最新链上监测显示嫌疑人已向 Tornado Cash 转入 430.2 ETH（约 107 万美元），并通过 SUN.io 及 USDD PSM 将 USDT 兑换为 USDD，部分资金流入 Binance 热钱包，相关钱包仍持有约 7060 万美元资产；设备篡改与攻击者身份仍未证实。", "current_state_en": "The Ledger-related supply-chain attack has confirmed losses approaching $90 million, with MistTrack tracking funds and Tether freezing substantial USDT; latest on-chain monitoring shows suspects moved 430.2 ETH (~$1.07M) to Tornado Cash and converted USDT to USDD via SUN.io and the USDD PSM, with some funds routed to a Binance hot wallet, while suspect wallets still hold ~$70.6M; device tampering and attacker identity remain unconfirmed.", "detailed_summary_zh": "Suspects in the ~$90M Ledger distributor theft moved 430.2 ETH (~$1.07M) into Tornado Cash and, after Tether froze assets, converted USDT to USDD via SUN.io and the USDD PSM, with part of the funds routed to a Binance hot wallet while roughly $70.6M in traced assets reportedly remains in suspect wallets.", "detailed_summary_en": "Suspects in the ~$90M Ledger distributor theft moved 430.2 ETH (~$1.07M) into Tornado Cash and, after Tether froze assets, converted USDT to USDD via SUN.io and the USDD PSM, with part of the funds routed to a Binance hot wallet while roughly $70.6M in traced assets reportedly remains in suspect wallets.", "background_zh": "Tornado Cash 是一个开源、非托管的混币协议，运行于兼容以太坊虚拟机（EVM）的网络之上，用于切断资金来源与去向地址之间的链上关联；美国财政部曾于 2022 年 8 月将其列入黑名单，2024 年 11 月美国联邦上诉法院推翻了这一裁定。USDD 的 PSM（锚定稳定模块）是 USDD 内置的固定汇率兑换功能，可在 USDD 与支持的稳定币之间按 1:1 比例兑换。", "background_en": "Tornado Cash is an open-source, non-custodial mixer on Ethereum Virtual Machine-compatible networks that obscures the link between source and destination addresses; the U.S. Treasury blacklisted it in August 2022, and a U.S. federal appeals court overturned that ruling in November 2024. The USDD PSM (Peg Stability Module) is USDD's built-in fixed-rate swap feature that converts between USDD and supported stablecoins at a 1:1 rate.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "此事显示出稳定币发行方的冻结权会推动被盗资金转向 USDD 等替代稳定币以及 Tornado Cash 等混币工具，这一路径涉及 USDT/USDD 兑换流动性以及流入 Binance 等中心化交易所热钱包的资金。据称仍留在嫌疑钱包中的约 7060 万美元资产，是后续链上资金传导的主要观察点。", "market_impact_en": "The episode illustrates how stablecoin issuer freeze powers can push stolen funds toward alternative stablecoins such as USDD and toward mixers like Tornado Cash, a channel that touches USDT/USDD swap liquidity and deposits into centralized-exchange hot wallets such as Binance's. The reported ~$70.6 million still sitting in suspect wallets is the main on-chain transmission point to watch.", "importance_score": 7.5, "references": [ { "url": "https://en.wikipedia.org/wiki/Tornado_Cash", "title": "Tornado Cash" }, { "url": "https://docs.usdd.io/psm/the-psm", "title": "The PSM | USDD Docs" }, { "url": "https://docs.usdd.io/user-guide/psm-peg-stability-module", "title": "PSM | USDD Docs" } ], "confidence": 0.95, "story_ids": [ "telegram:theblockbeats:199759" ], "sources": [ { "url": "http://sun.io/", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_da79d307f72c844d", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T16:40:29Z", "published_at": "2026-10-09T16:40:29Z", "first_seen_at": "2026-10-09T18:27:35.835620Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Ledger 称东南亚经销商与 8600 万美元盗取事件有关", "title_en": "Ledger says Southeast Asia reseller linked to $86M draining", "what_changed_zh": "Ledger 官方确认正在调查与经销商 CryptoBilis 相关的供应链攻击，并要求 CryptoBilis 暂停所有 Ledger 设备的销售和发货；建议过去 90 天从 CryptoBilis 购买设备的用户不要进行初始化设置，若已设置则把资产转移到新的 Ledger 签名器。", "what_changed_en": "Ledger officially confirmed it is investigating a CryptoBilis-linked supply-chain compromise and told CryptoBilis to pause all sales and shipments of Ledger devices; users who bought devices from CryptoBilis in the past 90 days were advised not to initiate setup and, if already set up, to move assets to a new Ledger signer.", "current_state_zh": "Ledger 官方确认调查与经销商 CryptoBilis 相关的供应链攻击，已要求其暂停 Ledger 设备销售和发货，并建议受影响用户迁移资产到新签名器；损失估计超过 8000 万至 8600 万美元，此前链上追踪显示约 9000 万美元相关损失，Tether 已冻结部分 USDT，嫌疑人曾向 Tornado Cash 转入 430.2 ETH 并通过 SUN.io/USDD PSM 兑换 USDD；设备篡改细节与攻击者身份仍未证实。", "current_state_en": "Ledger has officially confirmed it is investigating a CryptoBilis-linked supply-chain compromise, instructed the reseller to pause Ledger device sales and shipments, and advised affected users to migrate assets to a new signer; loss estimates range above $80M–$86M, with earlier on-chain tracking indicating ~$90M in related losses, Tether freezing some USDT, and suspects moving 430.2 ETH to Tornado Cash and converting USDT to USDD via SUN.io/USDD PSM; device tampering details and attacker identity remain unconfirmed.", "detailed_summary_zh": "Ledger confirmed it is investigating a supply-chain compromise tied to Southeast Asian reseller CryptoBilis, which has been linked to over $80 million drained from users who bought Ledger devices through it, prompting advice to affected buyers to move assets to a new signer.", "detailed_summary_en": "Ledger confirmed it is investigating a supply-chain compromise tied to Southeast Asian reseller CryptoBilis, which has been linked to over $80 million drained from users who bought Ledger devices through it, prompting advice to affected buyers to move assets to a new signer.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.95, "story_ids": [ "rss:protos.com_feed_:603706f2779b95ac" ], "sources": [ { "url": "https://protos.com/ledger-says-southeast-asia-reseller-linked-to-86m-draining/", "label": "Protos", "source_type": "rss", "official": false } ] }, { "update_id": "upd_3f0d1f28ed46e4fb", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T21:10:39Z", "published_at": "2026-10-09T21:10:39Z", "first_seen_at": "2026-10-09T22:30:50.383722Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Ledger 黑客恐慌规模接近 9000 万美元，Tether 着手冻结被盗 USDT", "title_en": "Ledger hack scare nears $90 million as Tether moves to freeze stolen USDT", "what_changed_zh": "行业人士开始公开介入调查：币安创始人赵长鹏警告用户谨慎，称事件似乎局限于单一供应商的供应链攻击；前 Mt. Gox CEO Mark Karpelès 正在调查是否有恶意硬件组件被植入发给客户的设备，并要求 CryptoBilis 打开部分未售出的 Ledger 钱包检查内部电路板。此外，报道指出 Ledger 的 Genuine Check 只能验证安全芯片，可能无法发现硬件其他部位的物理篡改。", "what_changed_en": "Industry figures publicly intervened: Binance founder Changpeng Zhao warned users and said the incident appears localized to a single-vendor supply-chain attack; former Mt. Gox CEO Mark Karpelès is investigating whether malicious hardware components were implanted in customer devices and asked CryptoBilis to open some unsold Ledger wallets for circuit-board inspection. Reports also note Ledger's Genuine Check verifies the Secure Element but may not detect physical modifications elsewhere in the hardware.", "current_state_zh": "Ledger 正在调查与东南亚授权经销商 CryptoBilis 相关的用户资金损失事件；Ledger 已要求 CryptoBilis 暂停销售和发货，并对过去90天内购买设备的客户发出警示。链上研究人员估计相关损失约为7200万至9000万美元，Tether 已冻结相关 USDT。赵长鹏等业内人士公开评论并呼吁行业协助追踪资金，Mark Karpelès 正调查设备是否植入恶意硬件组件，但攻击方式、设备是否被篡改及攻击者身份仍未确认，调查仍在进行中。", "current_state_en": "Ledger is investigating reported fund losses tied to Southeast Asian authorized reseller CryptoBilis; Ledger has asked CryptoBilis to suspend sales and shipments and warned customers who bought devices in the past 90 days. Onchain researchers estimate losses at roughly $72 million to $90 million, and Tether has frozen related USDT. Industry figures including Changpeng Zhao have publicly commented and called for industry help tracing funds, while Mark Karpelès is investigating whether malicious hardware components were implanted; the attack method, device tampering and attacker identity remain unconfirmed, and the investigation is ongoing.", "detailed_summary_zh": "Ledger suspended sales and shipments through Southeast Asian reseller CryptoBilis and urged recent buyers to move funds to fresh wallets, while Tether froze USDT tied to suspected thefts from Ledger customers that investigators estimate at nearly $90 million.", "detailed_summary_en": "Ledger suspended sales and shipments through Southeast Asian reseller CryptoBilis and urged recent buyers to move funds to fresh wallets, while Tether froze USDT tied to suspected thefts from Ledger customers that investigators estimate at nearly $90 million.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.92, "story_ids": [ "rss:cryptoslate.com_feed_:b3e002b0e69feb53" ], "sources": [ { "url": "https://cryptoslate.com/ledger-hack-scare-nears-90-million-as-tether-moves-to-freeze-stolen-usdt/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] } ] }