Ledger has confirmed that a sophisticated supply-chain attack compromised its hardware wallets, enabling a criminal organization to steal tens of millions of dollars from users.
Attack Overview
Customers in Southeast Asia reported losing funds after purchasing Ledger devices from CryptoBilis, a reseller based in Malaysia. Ledger’s investigation uncovered an unauthorized hardware implant inside at least one of the reported units. The implant was capable of reading the seed phrase stored on the device, allowing the attackers to empty the associated wallets. Blockchain analyst Specter estimated that the operation resulted in the loss of about $86 million.
Supply-Chain Vulnerability
According to Ledger, the perpetrators bought genuine devices, modified them with their own implants, and then re-entered the devices into the distribution network through legitimate resellers. The company stresses that the breach did not involve any flaw in its chips, operating system, or internal servers. Instead, the compromise occurred after the products left Ledger’s direct control, highlighting a weakness in the broader hardware supply chain.
Ledger’s Response
Ledger launched its largest investigation to date, dispatching staff to markets across Europe and Asia to audit the integrity of devices in circulation. Early results indicated that screened devices were clean, and the firm has temporarily halted sales through authorized distributors in Southeast Asia and Hong Kong while the review continues. Ledger is also collaborating with law-enforcement agencies to trace the stolen funds and dismantle the attackers’ infrastructure.
Broader Context
The incident follows a July hack that saw almost $120 million in Bitcoin stolen from users of the Coldcard hardware wallet. 2023 has also seen multiple data breaches targeting Ledger’s payment processor, Global-e, underscoring a trend of attackers seeking both technical and personal data to compromise crypto assets.
Why it matters
The breach raises serious concerns about the security of hardware wallets, which are widely regarded as the safest way to store private keys. A successful tampering of devices after manufacture but before reaching end users demonstrates that even reputable manufacturers can be vulnerable to supply-chain attacks. For investors and everyday users, the episode underscores the importance of purchasing hardware wallets through trusted, verified channels and the need for ongoing industry vigilance against sophisticated criminal operations.
