Community Trust ScoreVerified
An organized criminal group spent millions to physically hack Ledger devices, install hardware implants, and then circulate them through resellers. Estimated losses: $86 million.
Why It Matters
This incident underscores the vulnerabilities in the hardware wallet supply chain, highlighting the potential for sophisticated attacks that exploit physical security rather than digital weaknesses. As trust in hardware wallets is paramount for safeguarding cryptocurrencies, this breach could lead to increased scrutiny and demand for enhanced security measures within the crypto hardware market. Furthermore, the incident may deter new users from entering the space, impacting overall adoption and investment in decentralized finance solutions.
Ledger, the Paris-based manufacturer of hardware wallets, revealed the information on Thursday. A structured, patient group with significant resources purchased legitimate Ledger devices, opened them, inserted an implant capable of reading users’ recovery phrases, and then reintroduced them into the distribution chain via resellers. This wasn’t a server hack or a code leak. It was a physical, manual operation planned over the long term.
CryptoBilis at the Center of the Investigation
It all began when customers in Southeast Asia reported losing funds after purchasing their devices from a Malaysian reseller: CryptoBilis. Ledger launched an investigation, confirming that at least one of the examined devices contained an unauthorized hardware implant.
Exactly how much money has gone up in smoke? Ledger did not respond to written questions on this point. Blockchain investigator Specter, however, put a figure on the table: $86 million drained from compromised devices. It’s unclear if this is a high or low estimate. No further details from Ledger.
And that’s where it hurts. $86 million isn’t a bug; it’s an infrastructure.
Servers, Draining, Laundering: A Well-Oiled Machine
The group didn’t improvise. According to Ledger, they built their own logistical and technological infrastructure from scratch. Dedicated servers for collecting recovery phrases. Systems to drain targeted wallets. Structures to launder the stolen funds afterward. They operated in a coordinated manner, waiting for the right moment before emptying accounts.
Ledger wants to clarify an important point: no vulnerabilities were found in their chip, operating system, or servers. Their own systems were not compromised. The attack targeted the distribution chain after the devices left the factory. This distinction matters for the company’s reputation, even if for the victims, the result is the same.
Not now, not ever, do Ledger devices themselves seem to have been manufactured with a defect. The problem is what happens afterward.
Field Investigation and Collaboration with Authorities
Ledger has sent employees to other markets, including Europe, to verify that other supply chains have not been targeted. The devices examined in these markets were intact. Authorized resellers in Southeast Asia and Hong Kong have suspended their sales while the investigation progresses.
Ledger is working with law enforcement to trace the funds and dismantle the criminal infrastructure. The exact number of affected customers remains unknown. Probably more than currently known.
This is the largest internal investigation Ledger claims to have conducted to date.
The crypto sector is still reeling from an attack last July where hackers stole nearly $120 million in bitcoin from Coldcard users. Several data breaches have also been reported this year, with scammers targeting Ledger to retrieve customer information via the payment processor Global-e. Essentially, Ledger has become a prime target, not just for its devices, but for everything surrounding them.
The sophistication of the criminal group here is mainly patience. Investing in servers, building laundering pipelines, infiltrating physical resellers — it takes time and money. It looks less like a group of opportunists and more like an organization with real resources and a plan spanning several months.
Authorized resellers have halted sales. The investigation is ongoing. But the number of victims remains unclear.
Frequently Asked Questions
How much money was stolen in the attack on tampered Ledger devices?
Blockchain investigator Specter estimates the losses at $86 million, although Ledger has not officially confirmed this figure and has not responded to written questions about the exact amount.
How did the criminal group compromise Ledger devices?
The group purchased legitimate Ledger devices, installed hardware implants capable of reading users’ recovery phrases, and then reintroduced them into the supply chain via resellers, including the Malaysian reseller CryptoBilis.
Were Ledger’s internal systems hacked?
No. Ledger states that no vulnerabilities were detected in their chip, operating system, or servers — the attack targeted the distribution chain after the devices left their direct control.
