An important correction now sits alongside the rising loss estimate in the Ledger–CryptoBilis investigation. On October 12, blockchain-analytics firm Bitquery withdrew its earlier suggestion that transfers from four Tron wallets to Binance represented payments connected to the attacker. Those wallets were THORChain vault infrastructure, and the Binance-bound transfers belonged to other users of the swapping service. That lead should no longer appear in an account of the theft as proven attacker activity.
On the same day, Bitquery raised its estimate of the stolen assets to $102.0 million from 324 wallets across six blockchains. Its October 11 tally had been $93.2 million from 315 wallets. The numerical change is attributable to nine additional Tron wallets whose estimated 8.8 million USDT outflow occurred on October 9 at 20:49 UTC but was discovered later. These figures are Bitquery's analytical estimate, not Ledger's audited or confirmed total victim loss.
The October 12 reconciliation
The arithmetic behind the revision is unusually transparent: 315 previously counted wallets + 9 newly identified wallets = 324; $93.2 million + $8.8 million = $102.0 million, with both values rounded in the analyst's reporting. The newly detected transfer is dated October 9, not October 12. WikiBit therefore records it as newly discovered evidence of an older drain, rather than a new hack on October 12.
Bitquery traces victims and suspect flows on Tron, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. It argues that wallet approvals and coordinated transfers suggest one operator had access to multiple victims' signing material. That is a forensic inference; it does not alone establish how the operator obtained that access or how many physical devices were altered.
Ledger has confirmed that an unauthorized hardware implant was found in at least one affected wallet acquired through CryptoBilis. Its consumer precautions and reseller response apply to the affected sales channel in Southeast Asia. This is not a confirmation that every Ledger unit—or every device sold by a reseller—contains an implant. Nor does one physical finding establish the exploit mechanism for every address in an analyst's multi-chain cluster.
Why the THORChain correction changes the story
The earliest trace treated four Tron addresses as an OTC-style cluster and associated payments reaching Binance with the thief. Bitquery subsequently identified those addresses as THORChain vaults. The service received stolen assets for swaps into ETH, but separate outbound transfers by unrelated THORChain users had been wrongly joined into the suspect's trail.
The correction does not negate the use of THORChain in the attacker path. It does negate the specific inference that those Binance transfers represented the thief's cash-out. Mixing service-infrastructure addresses with their many users is a well-known tracing hazard. WikiBit will not repeat the retracted allegation or describe Binance as having received those amounts from the attacker on that evidence.
This also limits what can be claimed about recovery: a transaction entering a public vault or bridge proves a technical interaction, not a final beneficial owner or a confirmed fiat off-ramp.
What was frozen, what might be frozen, and what moved on
Bitquery reports approximately 10.0 million USDT frozen by Tether, distributed across 20 linked wallets. This is a security-research account of issuer action; it is not an announcement of reimbursement to victims. Frozen tokens and funds actually returned to victims are different outcomes.
By October 12, the firm also identified 2.38 million USDC in two wallets it considered likely attacker-controlled and said Circle could freeze that balance. “Could freeze” is not “has frozen.” The analyst separately corrected its earlier account of 5.35 million USDC in five wallets: those balances had been emptied before any freeze. Neither amount should be reported as a completed Circle seizure.
Bitquery's tracing says approximately 6,680 ETH entered Tornado Cash over October 9–12, with further movement through Zcash and swap infrastructure. It estimated that about $82 million remained on-chain traceable at its October 12 snapshot. “Traceable” does not mean controlled, seized, frozen or recoverable. All balances are time-sensitive and depend on address-clustering assumptions.
The reseller response has expanded beyond Ledger
The risk is no longer confined to a single manufacturer's consumer notice. On October 12, OneKey independently revoked CryptoBilis's reseller authorization and offered free replacement devices to qualifying buyers, while explicitly stating it had no reports of OneKey users losing assets in this incident. That proactive recall is not evidence that OneKey devices have suffered the same compromise. The precise eligibility, replacement deadline and seed-migration guidance are covered separately in OneKey's CryptoBilis response.
For Ledger owners who bought through the implicated channel, the central precaution remains to move assets to a wallet generated from a genuinely fresh recovery phrase on a trusted device and not to carry forward the potentially exposed seed. Unused suspect devices should not be initialized. The company has not published a device-by-device public inventory establishing every affected unit.
Evidence boundaries
Confirmed — manufacturer: Ledger's finding of at least one unauthorized physical implant, its warning to affected CryptoBilis buyers and ongoing investigation.
On-chain / developing — Bitquery, October 12: $102.0 million estimate, 324 wallet count, extra 8.8 million USDT historical drain, approximately 10 million USDT reported frozen, 6,680 ETH mixing route and the $82 million traceability estimate. These are not manufacturer-confirmed economic losses.
Correction — Bitquery, October 12: THORChain service infrastructure was misidentified in the earlier Binance-related trace; unrelated users' payments should be excluded.
Not established: final victim count, complete tampering method and production point, final recoveries or compensation, any general vulnerability affecting all Ledger devices, or confirmed theft from devices made by other vendors.
Risk and continuing response
The risk remains Critical because physical-device integrity, recovery-phrase secrecy and a large potentially coordinated compromise all intersect. WikiBit's next checkpoints are Ledger's forensic report, the number of independently confirmed altered devices, reconciliation of competing chain estimates, issuer freezes and actual victim repayments. Buyers should disregard anyone promising recovery in exchange for a seed phrase or a transaction to an unfamiliar “verification” wallet.
