CZ Calls BNB Ecosystem to Trace $92.9 Million Ledger Reseller Drain

A $92.9 Million Drain Across Five Networks

Ledger is investigating a wallet drain that on-chain analysis now values at $92.9 million across 311 wallets on five networks: Bitcoin, Ethereum, and the altcoin networks TRON, BNB Chain and Polygon. The incident surfaced on Friday, Oct. 9, when researchers began tracing outflows from wallets belonging to customers in Southeast Asia who had bought hardware wallets through CryptoBilis, a reseller listed as an official distributor in Indonesia, Malaysia and the Philippines. First estimates put losses above $72 million; a second pass over the transaction graph lifted the reported total to $92.9 million. Ledger has asked CryptoBilis to pause all sales and shipments pending the outcome, and its support account issued precautionary customer guidance for anyone who bought from the reseller in the previous 90 days: leave an unopened device uninitialized, and if setup is already complete, consider moving assets to a new signer with a fresh seed. Binance founder Changpeng Zhao, known as CZ, said the information then available pointed to a localized supply-chain incident involving one vendor, under which a small number of buyers may have received counterfeit or tampered devices. In a post on X, he called on BNB ecosystem players and the wider industry to help trace and recover the funds, describing the device line as one of the industry's longest-tested, a note aimed at damping FUD around the brand. The BNB exposure runs through the affected chains rather than any named protocol: the drain touched BNB Chain as one of five networks, in a sector where targeted BNB thefts are not unprecedented, as when 79thVault lost $12.5 million in BNB through a compromised operator key. Ledger said it would keep customers informed as the investigation progresses.

Tether Freezes $10 Million as Tracing Widens

Hardware wallets are designed to keep the private key offline, so the open question is how funds left the victim addresses at all. On-chain work by the analytics firm Bitquery shows small test transactions roughly two weeks before the main outflows, followed by coordinated transfers across multiple networks. Researchers also observed groups of victim wallets signing similar requests within seconds of one another, a pattern consistent with preparation and a common point of control, though the transaction record alone cannot show how the attacker obtained access. The distinction matters because a drained wallet is not, by itself, proof of a platform breach. A separate investigation by Specter traced suspicious addresses that received funds from hundreds of victim wallets across Ethereum, TRON and Bitcoin, estimating losses above $86 million. Tether has reportedly frozen about $10 million in USDT across 20 wallets tied to the suspected theft; the action stops those tokens from moving but does not by itself return anything to victims. At the analysis cutoff, roughly 14,810 ETH sat in wallets attributed to the attacker, while about 203.8 BTC in associated Bitcoin addresses had not moved. Bitquery further identified about 1,254 ETH routed through Tornado Cash and Zcash, with the funds later surfacing in three new wallets, one holding around 2.1 million USDC. That balance could offer a second intervention route, depending on the issuer's review of the addresses involved, though no freeze should be assumed until confirmed. Separately, former Mt. Gox CEO Mark Karpelès published photographs of a Ledger Nano X he said had reached him from Malaysia: the shrink-wrap appeared intact, with a concealed electronic module where the screen padding should sit. He noted hardware implants have grown more sophisticated. Ledger has not confirmed that the module was functional or connected to the CryptoBilis case.

Ledger Has Not Confirmed a Cause

The documented record so far covers the outflows, the tracing and the $10 million freeze; it does not cover the access method. Nothing in the evidence establishes a breach of Ledger's core infrastructure, and nothing confirms counterfeit or modified devices as the vector, though both hypotheses sit comfortably beside the timing of the test transactions. Ledger itself has stopped short of naming a cause. The BNB price has not been tied to the disclosure by any verified data, and the chain appears in the record only as one of five networks carrying stolen funds. What would settle the question is Ledger's forensic finding on where the compromise sat, whether in reseller stock or elsewhere in the supply path. Until then, the confirmed response is the reseller suspension, the customer guidance and the freeze.