Ledger Reseller Attack Linked to $93M Crypto Theft

A Ledger reseller attack has been linked to more than $86 million in stolen crypto, with one estimate putting losses at about $93.2 million. The affected hardware wallets were reportedly sold by Southeast Asian reseller CryptoBilis, which suspended sales and shipments during the investigation. Ledger said its own systems were not compromised; the number of affected devices and the final loss total remain uncertain. Investigators say an unauthorized module connected to the device screen’s data lines could capture a 24-word recovery phrase when displayed and send it over a cellular connection. The device could still pass Ledger’s software authenticity check, and the secure element was reportedly not extracted or compromised. The Ledger reseller attack therefore points to physical supply-chain risks that software checks may not detect. Blockchain tracking reportedly followed funds across six chains and 315 wallets. About 2,990 ETH passed through Tornado Cash before reaching a Zcash privacy pool. Tether froze roughly $10 million in USDT; some funds were reportedly converted to USDD, while about 700 ETH remained unmoved at the time of reporting. Ledger advised customers who bought devices from CryptoBilis within the previous 90 days not to initialize unused devices. Users who had set up a device should move assets to a new signer using a freshly generated recovery phrase on trusted equipment.