POPA ReconLedger wallet drain reports: whether an ongoing supply-chain attack is confirmed and what evidence supports the reported losses and addresses
Reports describe more than $86 million in losses across hundreds of wallets, and on-chain activity confirms recent transfers from several addresses named in the reports. The evidence does not establish that Ledger devices or its supply chain were compromised, or independently verify the aggregate loss estimate.
Reported losses and scope
On October 9, SpecterAnalyst said reports from Ledger users on X and Reddit pointed to more than 100 victim wallets across Ethereum, TRON and Bitcoin, with losses exceeding $86 million. The named destinations appear in SpecterAnalyst’s post. Earlier, a post by Tanuki42_ cited a figure above $72 million, also described as increasing (post). These are investigator-reported totals, not an independently reconciled loss ledger. The initial report also said the method and any vulnerability in Ledger devices had not been established (Coinness report).
On-chain evidence
On October 9, the Ethereum address 0x83ae…a599 sent 124,142.952049 USDT to 0x1481…db70. The address 0x0336…4f7a sent 49,990.00111 USDT to the same recipient and also sent 100,008.900873 USDC there. The third listed Ethereum address, 0x69c8…7841, routed about 10.0 billion PEPE through LiFi and Uniswap; the transaction’s transfers show swaps and distributions to several other addresses (transaction).
On TRON, the reported address TK6D…xT6C was sending USDT in multiple transfers, including 500,000 USDT transfers and a later roughly 10 million USDT transfer. TBkc…rs9d9 also sent several 500,000 USDT transfers, followed by a roughly 4.17 million USDT transfer. TSDW…Ar5a sent roughly 5.0 million USDT in a recent transfer. This activity supports that the listed destinations were moving substantial funds, but the available records here do not establish the source of every inflow or show the reported Bitcoin addresses’ activity.
What remains established
The posts and transfers support reports of large, multi-chain theft flows and identify addresses investigators associated with them. They do not prove those losses came from a Ledger software or hardware supply-chain compromise; the sources do not name a confirmed attack vector or independently establish the $86 million total.