Galaxy Research's onchain accounting of the Ledger supply-chain exploit now puts total confirmed losses at $91 million across 474 victim addresses, according to an update posted by CoinMarketCap on October 17, 2026. The figure is the clearest measure yet of how far the compromise reached, and it marks a jump from the earlier estimate tied to the same incident.
The tally matters because supply-chain attacks rarely announce their own size. Funds leave wallets quietly, often across many chains and over several days, so the true damage only comes into focus once analysts trace the flows on-chain. Galaxy's count of 474 distinct victim addresses turns a vague "major breach" into a specific, verifiable number.
The breach traced back to the device itself
The losses stem from a compromise in how affected Ledger devices were built and distributed, not from users mishandling their own seed phrases. That distinction is the uncomfortable part. Hardware wallets are marketed on a single promise: your private keys never leave the device. When the device or its supply path is the point of failure, the usual advice to "just use cold storage" stops being a complete answer.
We have covered the origin of this incident separately. Earlier reporting confirmed a hidden hardware implant tied to the thefts, and the gap between that earlier dollar figure and Galaxy's $91 million shows how these counts grow as more addresses are linked to the same attacker infrastructure. Treat the current number as a floor, not a ceiling. Onchain tallies typically rise before they settle.
474 scattered addresses point to a broad base of holders
A single large theft from one whale is one kind of story. Losses spread across 474 separate addresses is a different one. It points to a broad base of ordinary holders rather than a handful of concentrated targets, which is consistent with a compromise that sits upstream of any individual user, in the manufacturing or distribution layer, rather than a targeted phishing campaign.
For anyone holding assets on a Ledger device, the practical read is straightforward. Check whether your device falls within the affected batches as the company and independent researchers publish details, and move funds to a verified, uncompromised setup if there is any doubt. Self-custody still removes exchange and counterparty risk, but it concentrates responsibility on the integrity of the hardware and the chain that delivered it to you.
The custody lesson cuts both ways
This incident is a hard case for the self-custody argument, though not a fatal one. The core claim behind holding your own keys remains true: no exchange freeze, no withdrawal halt, no third party deciding when you can touch your money. What the Ledger exploit exposes is a quieter dependency. Even in self-custody, you are trusting the people who designed, assembled, and shipped the thing in your hand.
That trust is not unique to hardware wallets. It applies to spending from your own wallet through non-custodial cards, to the firmware on any signing device, and to the software clients that broadcast your transactions. The useful response is not to abandon self-custody but to narrow where you place blind trust: buy hardware directly from the manufacturer, verify firmware signatures, and keep the bulk of long-term holdings on a setup you can independently attest to.
The broader custody question runs through much of the crypto card market too. Cards that let you spend stablecoins or on-chain balances inherit the security model of whatever wallet sits behind them. A breach at the hardware or key-management layer does not stay contained to cold storage; it reaches every surface that touches those keys.
Context at the time of writing
The disclosure landed in a flat market. Bitcoin traded at roughly $81,574, down 0.8% on the day, with the Fear and Greed index at a neutral 49 as of October 17, 2026. There is no sign the exploit moved prices, which fits the pattern: targeted security failures hit the victims directly rather than the asset's valuation. The cost here is borne by 474 wallets, not by the market at large.
What happens next depends on tracing. If Galaxy and other analysts link more addresses to the same attacker flows, the $91 million figure will rise. Exchanges and mixers that receive the stolen funds become the next chokepoint, and any freezes or recoveries there will shape how much of the $91 million is ever clawed back.
Overview
Galaxy Research's onchain tally now attributes $91 million in losses to the Ledger supply-chain exploit, spread across 474 victim addresses, per a CoinMarketCap update on October 17, 2026. The breadth of affected wallets points to a compromise in the device supply path rather than user error, and the count is likely to grow as more addresses are traced. The takeaway for holders is specific: verify your device's provenance and firmware, and do not assume self-custody alone neutralizes hardware-layer risk.
