Ledger Confirms Over $86 Million in Crypto Assets Lost in Hardware Supply Chain Attack Incident

On-chain detective Specter revealed in his personal channel that an attacker address, implanted via unauthorized hardware into a Ledger hardware wallet linked to CryptoBilis, deposited 2,990 ETH (valued at approximately $7.45 million) to Tornado Cash between October 9 and 10. Monitoring data shows the attacker had earlier dispersed the funds to 14 addresses, then cross-chain converted the funds to the ZEC network via NEAR Intents for further privacy processing. Signs of address correlation were observed during the fund transfers: some withdrawal transactions reused the wallet addresses used for prior deposits, while other withdrawals were initiated by wallets linked to the wallet that paid gas fees during the theft, enabling researchers to trace the fund flow.

After hardware wallet manufacturer Ledger confirmed that devices sold by its Southeast Asian distributor CryptoBilis contained unauthorized hardware implants, analyst Darkfost has compiled a "Ledger Dealers to Watch" list, identifying nearby merchants whose supply chains may also be impacted, including Lazada, Shopee, Tokopedia, Bhinnekon, and Metapod. The list marks CryptoBilis as suspended, while the risk exposure of other dealers remains unknown. Darkfost stressed this is speculative, not confirmed, but advised users who purchased Ledger devices from these dealers in the past six months to transfer their assets to secure locations before the issue is resolved. Ledger previously stated the incident appears limited to this single distributor and its local market, adding its own infrastructure, systems, and services were not breached, and investigations are ongoing. Darkfost also recommended users willing to inspect their devices themselves refer to disassembly guides to verify if the hardware has been tampered with.

Next week, global markets will focus on the U.S. September CPI data to assess whether the Federal Reserve maintains its "discontinuous rate hike" stance. While most Fed officials believe another rate hike may be possible this year, recent comments indicate no urgency to act at consecutive meetings. Market pricing for a rate hike on October 28 has fallen to around 19%, while a December rate hike is fully priced in. Geopolitically, the stalemate between the U.S. and Iran and escalating tensions in Yemen continue to support oil risk premiums, with the U.S.-Russia diesel supply deal having limited short-term impact. Below is a key event calendar: Tuesday: Speech by Cleveland Fed President Patrick Harker; Fed Governor Christopher Waller speaks at the India Bloomberg New Economy Forum; U.S. September NFIB Small Business Confidence Index, ADP employment change for the week ending September 26, September existing home sales annualized total; OPEC releases its monthly oil market report. Wednesday: U.S. September CPI and core CPI; Fed officials’ pre-Brown Book comments; Boston Fed President Susan Collins and Fed Governor Michelle Bowman deliver speeches; IEA releases its monthly oil market report. Thursday: U.S. API crude oil inventories for the week ending October 9; U.S. initial jobless claims for the week ending October 10, September retail sales, September PPI and core PPI, October New York Fed and Philadelphia Fed manufacturing indexes; G20 Finance Ministers and Central Bank Governors Meeting. Friday: Fed Chair Jerome Powell attends the IMF Annual Meeting in Bangkok and holds a fireside chat with IMF Managing Director Kristalina Georgieva; Cleveland Fed President Patrick Harker speaks again; U.S. September Import Price Index, industrial production; U.S. EIA crude oil inventories for the week ending October 9.

According to TradingBeats monitoring, Hyperliquid whale address 0x8ea8…edbc holds 1,000 BTC long positions, with the position valued at approximately $83.04 million. The address uses 3x full leverage, with an average entry price of around $72,771, current unrealized profit of roughly $10.27 million, and a position return rate of about 37.1%. The address already held around 800 BTC long positions as early as May 11, with an unrealized profit of approximately $5.3 million at that time, before increasing the position size to 1,000 BTC. As of press time, the BTC contract mark price is approximately $83,037, some 14.1% higher than the address’s average entry price. The estimated liquidation price for the position is around $50,382, roughly 39.3% lower than the mark price.

According to TradingBeats’ monitoring, address 0x6f25...4acc has recorded a cumulative trading volume of roughly $10.301 billion on Papertrade, with historical trading losses of around $933,200 and currently holds no open positions. All 1,058 settled positions of the address utilized 1000x leverage; 37 were liquidated, leading to total margin losses of approximately 361,000 USDC, involving BTC and ETH. Separately, the address has staked about 84.98 million PAPER tokens, making up roughly 1.59% of the platform’s total staked amount, and has cumulatively claimed around 223,900 USDC in rewards.

On the Hyperliquid platform, ETH’s 24-hour trading volume exceeded BTC’s $805 million, reaching approximately $1.1 billion. Market analysts link the surge in ETH’s trading volume to suspected exploitation of PaperTrade’s mechanisms. Earlier today, reports indicated PaperTrade was targeted for price manipulation by two wallet addresses, with clear vulnerabilities in the protocol. The two addresses conducted trades on Hyperliquid at individual sizes of around $20 million, driving ETH’s price to fluctuate by 10 to 20 basis points, while establishing long positions worth hundreds of millions of nominal dollars on PaperTrade.