Ledger reveals $86 million theft via hardware wallet supply chain attack
Ledger’s supply chain attack uncovered
Hardware wallet maker Ledger announced that a sophisticated criminal group bought its devices, installed hidden hardware implants, and re‑sold them, allowing thieves to capture seed phrases and drain wallets. The attack targeted customers in Southeast Asia who bought from a Malaysia‑based reseller.
Ledger’s investigation confirmed at least one compromised device and identified a coordinated operation that built its own infrastructure for collecting, draining, and laundering stolen funds. The company says the breach occurred after devices left its control, not due to flaws in Ledger’s chips, operating system, or servers.
Key numbers
- One unauthorized hardware implant found in a Ledger device.
- Blockchain investigator Specter reports $86 million drained.
- Malaysian reseller CryptoBilis involved.
- Authorized resellers and distributors in Southeast Asia and Hong Kong suspended sales.
- Employees sent to Europe and other markets to check supply chains.
What Ledger says
Ledger stated the crime group spent millions building a logistics and technology network that included seed‑phrase collection servers and laundering tools. The attackers struck in a single coordinated operation. The company emphasized that its own systems were not compromised and that the attack targeted the distribution channel.
Following the discovery, Ledger halted sales through affected resellers, screened devices, and is working with law enforcement to track the stolen funds and dismantle the attackers’ infrastructure.
What is confirmed
One user’s Ledger device contained an unauthorized hardware implant.
The criminal group used custom servers to collect seed phrases and to drain wallets.
The attack originated from a reseller in Malaysia (CryptoBilis) and has led to suspended sales in Southeast Asia and Hong Kong.
Ledger has sent staff to other markets and is collaborating with authorities.
Specter, a blockchain investigator, reported $86 million stolen.
What is still unclear
The total amount of money lost is unknown.
The exact number of customers impacted has not been disclosed.
Details about the full scale of the criminal infrastructure remain under investigation.
Why this matters
The incident highlights supply chain vulnerabilities for hardware wallets, a critical security layer for crypto users. It follows a July breach that cost Coldcard users about $120 million and recent data leaks through payment processors, raising concerns about physical device tampering and reseller security.
What happens next
Ledger is continuing its investigation and cooperating with law enforcement to follow the funds.
Screened devices and authorized distributors are being verified to ensure no further tampering.
Sales through the affected Southeast Asian and Hong Kong resellers remain suspended pending further review.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.