Hundreds of Ledger hardware wallet users lost over $86 million in a suspected exploit on October 9, 2026, according to on-chain analyst Specter. Ledger has not said anything publicly about the cause.
The Big News
- Specter, the on-chain analyst posting as @SpecterAnalyst, traced over $86 million in losses from Ledger hardware wallet users.
- Some reports suggest the final figure could approach $100 million once more victims are identified.
- One Bitcoin address linked to the theft has reportedly received over 211 BTC, and those coins had not moved.
- Ledger has not confirmed any vulnerability in its devices or firmware and has stayed silent publicly.
Specter traces hundreds of victim wallets
Specter began tracing after users on X and Reddit reported drained Ledger wallets. The analyst followed the funds to several theft addresses that received inflows from hundreds of victim wallets on Ethereum, TRON and Bitcoin. That pattern fits a coordinated campaign hitting many holders at once. “Total losses $86M+,” Specter wrote.
There have been a reports on X and Reddit of wallet-draining by Ledger users. I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin. Total losses $86M+ bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9 TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a 0x83aeac166f6832ae3500000a24510a95a052a599 bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9 bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26n TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a
— Specter (@SpecterAnalyst) October 9, 2026
The Bitcoin address bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl is the one to watch. It has reportedly taken in over 211 BTC, and as of the report the attacker had left it untouched. Specter published these addresses tied to the theft:
- Bitcoin: bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl, bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9, bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26n
- TRON: TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C, TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9, TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW, TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a
- Ethereum: 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841, 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a, 0x83aeac166f6832ae3500000a24510a95a052a599
The attack vector is still unconfirmed
Nobody outside the attacker knows how the funds left the wallets. Discussion on X and Reddit has settled on three theories:
- A flaw in Ledger’s hardware or firmware.
- Compromised seed phrases, the recovery words that can rebuild a wallet anywhere and make the device itself irrelevant.
- Phishing through fake apps or websites that trick users into signing malicious transactions or handing over recovery words.
The on-chain trail shows where the money went. It does not show how the attacker gained signing access, so it cannot yet separate a device bug from mass seed theft.
The drain caps a rough year for crypto security and fraud in self-custody. Earlier this year, a fake Ledger Live app on Apple’s App Store drained about $9.5 million from more than 50 users. A flaw in the Zilliqa Ledger app also caused considerable losses for ZIL holders. In August 2026, a reported seed-generation flaw in Coldcard hardware wallets led to Bitcoin losses exceeding $88 million. The Ledger figure lands in the same range two months later.
Those precedents split along one line. The fake app and the Zilliqa issue lived in software built around Ledger devices. The Coldcard case traced back to how a device generated seeds. Which side this drain lands on decides the cleanup.
What To Monitor?
If phishing or a compromised third-party app is behind it, the fix is behavioral. First, verify software sources, never type a seed phrase into a computer or phone, and scrutinize every transaction before signing. A device or firmware fault would be harder to contain and could mean firmware updates or migrating funds to new wallets entirely.
Ledger has issued no statement naming a cause. Until it does, the clearest signal sits on-chain in that flagged Bitcoin address. Any outflow there would show the attacker starting to move the haul.
