Hardware Wallet Supply Chain Breach Triggers $86M Loss

A major manufacturer of cold storage devices is examining a substantial security incident that resulted in user funds being drained from self-custody wallets. The probe centers on physical devices distributed by CryptoBilis, an authorized regional reseller operating in Southeast Asia. The hardware producer has halted all sales through this vendor after confirming that at least one user received a device containing an unauthorized hardware implant.

The physical supply chain compromise appears to be running concurrently with a digital attack. Security researchers identified a large-scale phishing operation that successfully placed fraudulent websites at the top of Google Search results. These malicious links are designed to trick device owners into entering their 24-word recovery phrases, granting attackers full access to their digital assets.

Tracking the Stolen Assets

Multiple blockchain intelligence organizations have been monitoring the movement of the stolen cryptocurrency, with estimates varying based on the scope of their respective tracking efforts. Initial assessments from on-chain researchers placed the total drained funds at more than $86 million.

Independent analyst tanuki42 calculated the total damages to be in the range of $72 million to $86 million. The analytics provider Arkham reported monitoring over $80 million in diverted assets, while the tracking firm MistTrack assessed the total theft at approximately $90 million.

The highest estimates come from the blockchain analytics firm Bitquery. The firm initially reported that $92.9 million had been taken from 311 individual wallets. These thefts spanned five major blockchain networks: BNB Chain, Bitcoin, Polygon, Ethereum, and TRON. As the investigation continued, Bitquery updated its findings, showing that the total amount drained had grown to $93.2 million across 315 compromised wallets.

Tracing the Network Transfers

The wider cryptocurrency community first learned of the coordinated drain on October 9, 2026. At 12:24 UTC, an independent investigator operating under the pseudonym Specter issued a public alert. To assist in tracking the perpetrators, Specter released a list of 10 collection addresses distributed across the TRON, Ethereum, and Bitcoin networks.

A closer look at the on-chain activity reveals large, structured movements of digital assets. Specific monitoring of a TRON network address, identified by the tag TBkcU, showed a rapid influx of stablecoins. The address received 10 separate transfers of USDT, with individual transaction values ranging from $500,000 to $2.4 million. In addition to these primary transfers, the same address recorded two further deposits containing $740,000 and $508,000.

Despite the scale of the theft, mitigation efforts have yielded some success. Entities monitoring the situation have successfully frozen more than $10 million of the stolen cryptocurrency, preventing the attackers from moving those specific funds through external off-ramps. The hardware manufacturer continues to evaluate the full extent of the reseller breach.