Ledger Hardware Wallets Hit by Reseller Supply-Chain Attack

Ledger says a criminal group bought genuine hardware wallets, implanted hidden components and resold them through Southeast Asian distributors. The modified devices could steal recovery phrases during setup, enabling attackers to drain wallets. Ledger confirmed at least one implanted device after customers reported losses linked to Malaysia-based reseller CryptoBilis. Blockchain investigator Specter estimated about $86 million was stolen, but Ledger has not confirmed the total losses or number of victims. The attackers reportedly spent millions of dollars building systems to collect recovery phrases, move assets and launder funds. Ledger describes the incident as a distribution-channel attack, not a compromise of its chips, operating system or servers. It has asked distributors in Southeast Asia and Hong Kong to suspend sales while it checks inventory; sampling has found no other tampered devices so far. Ledger has banned resale of returned devices and instructed stores to hand products directly to customers at purchase. The company is working with law enforcement and security researchers to trace funds and dismantle the attackers’ infrastructure. The Ledger hardware wallet attack highlights supply-chain risks for crypto users, amid broader wallet-security concerns, including a reported July theft of nearly $120 million from Coldcard users.