Ledger says all confirmed cases in the recent cryptocurrency theft involve hardware wallets distributed by Southeast Asian reseller CryptoBilis. The company’s response has attracted criticism because CryptoBilis was listed on Ledger’s website as an authorized seller, prompting questions about the manufacturer’s accountability for products sold through its approved channel.

Blockchain analytics firms have traced as much as $93.2 million in cryptocurrency linked to wallets associated with devices purchased through the reseller.

Tether has frozen $10 million in USDT connected to the incident, while Ledger said Sunday that the investigation remains ongoing. The theft was first reported three days earlier.

Ledger confirmed that at least one affected device contained an unauthorized hardware implant. The company has not established whether the wallet from which funds were stolen was compromised through the same method, nor has it explained how the devices were altered.

Blockchain intelligence firm Bitquery estimated that $93.2 million was linked to the exploit. Its findings indicate that the attackers took primarily USDT and TRON tokens from 315 wallets across six blockchains. YFarmX, a security research platform, placed the estimated losses higher at $94.5 million, identifying activity involving 521 addresses across seven blockchains.

Both estimates are based on publicly available blockchain data and have not been confirmed by Ledger as the final amount lost.

Ledger did not immediately respond to CoinDesk’s request for comment on the estimated losses or whether it would offer compensation to affected customers.

Tether Blocks $10 Million in USDT

The $10 million freeze, confirmed by Bitquery, is an important development because stablecoin issuers can restrict access to tokens connected to suspected criminal activity. Bitcoin and ether do not have a centralized issuer capable of freezing individual holdings in the same manner.

Bitquery said about $81 million remained traceable onchain as of October 11. Some of the stolen funds had moved through Tornado Cash and Zcash, making their movement more difficult to follow.

Tether had not immediately responded to CoinDesk’s request for further details about the freeze.

Authorized Retailer Status Raises Accountability Concerns

Ledger’s insistence that confirmed cases are limited to CryptoBilis devices has prompted objections from users who believe the company should take responsibility for products sold through an authorized retailer.

“It’s not a CryptoBilis incident, it’s a Ledger incident,” X user MyCryptoParadise wrote, urging the company to address the matter directly.

The theft also differs from an April phishing campaign involving a counterfeit Ledger Live app distributed through Apple’s App Store. That incident reportedly resulted in at least $9.5 million in losses after victims entered their recovery phrases into the fraudulent application.

In the CryptoBilis-related cases, the attacker appears to have obtained the cryptographic keys necessary to drain hundreds of wallets directly, rather than persuading users to disclose their recovery phrases.

Ledger has advised customers who purchased devices through CryptoBilis not to activate unused units. Those who have already used their devices should transfer their assets to a new device configured with a newly generated recovery phrase, the company said.