The incident is described as Ledger-related, meaning the losses are connected in some way to the Ledger ecosystem rather than exclusively to the device firmware itself. U.
A wallet drain linked to Ledger hardware wallet infrastructure has reportedly drained approximately $92.9 million in assets across Bitcoin, Ethereum, and TRON, according to reporting by U.Today. The incident spans three separate blockchain networks, making it one of the more broadly distributed hardware wallet-related losses on record.
What the reported drain involves
The incident is described as Ledger-related, meaning the losses are connected in some way to the Ledger ecosystem rather than exclusively to the device firmware itself. U.Today’s investigation into the exploit provides the primary reporting on the $92.9 million figure; chain-by-chain loss allocations circulating on social media should be treated as unconfirmed until Ledger or a credible blockchain forensics firm publishes a verified breakdown. For related coverage, see Ledger Launches Morpho Loans Using Wrapped Bitcoin as Collateral.
The drain covers assets held across Bitcoin, Ethereum, and TRON wallets. Because the three networks use separate address formats and transaction models, a coordinated loss of this scale implies either a shared signing vulnerability, a compromised supply-chain component, or a targeted phishing campaign that extracted seed phrases rather than exploiting device firmware directly. For related coverage, see Coldcard Hack Reportedly Hit 1,000+ Bitcoin Addresses.
This is not the first time Ledger’s broader ecosystem has been implicated in large-scale losses. After Binance founder Changpeng Zhao urged wallet quarantine following an $86 million Ledger reseller hack, that attack similarly exploited a point in the supply chain outside the core device, illustrating that hardware wallet security extends well beyond the device itself. For related coverage, see Bitcoin Core Fixes Fund-Redirect Gap Without Private-Key Theft.
How Bitcoin, Ethereum, and TRON are each affected
Bitcoin’s UTXO model means any drained BTC is traceable on-chain from the compromised addresses through to destination wallets. On-chain investigators tracking the Bitcoin leg of the incident can monitor for consolidation activity on Mempool.space, where address clustering often reveals attacker wallet infrastructure.
Ethereum losses would include both ETH and any ERC-20 tokens held in affected wallets. TRON, which hosts a large volume of USDT stablecoin circulation, raises the possibility that stablecoin holdings form a significant share of the reported total, though no verified breakdown has been published.
The cross-chain nature of the drain is significant from a forensics standpoint. An attacker who drained all three chains simultaneously either obtained full seed phrases, which generate keys for all chains, or deployed separate exploits in parallel. Hardware wallet attacks affecting multiple chains have become a recurring pattern, as the Coldcard incident that reportedly hit more than 1,000 Bitcoin addresses demonstrated, where peripheral weaknesses such as supply chain tampering can undermine even devices with strong security reputations.
What this means for Ledger users
Until Ledger releases an official post-mortem, users who have held assets in Ledger-connected wallets should monitor their addresses for unauthorized outflows and avoid initiating new transactions until the attack vector is confirmed. If the exploit involved seed phrase extraction rather than a firmware vulnerability, moving assets to a freshly generated wallet with a new seed phrase on an uncompromised device is the appropriate response.
Ethereum users should additionally revoke any token approvals granted to smart contracts, since a compromised seed phrase exposes not just ETH balances but any approved contract interaction. TRON users holding USDT should contact Tether directly if they suspect live exposure, as Tether retains the ability to freeze specific USDT addresses in confirmed theft scenarios.
The $3 million XRP theft from Ellipal wallet users offers a comparable case study in how hardware wallet-adjacent attacks tend to progress from initial compromise to asset liquidation across multiple networks. Ledger has not published a formal statement confirming the $92.9 million figure as of the time this article was written; readers should follow Ledger’s official channels for verified updates.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
