Ledger-linked hack steals $86M in crypto

TLDR

A suspected supply chain compromise involving Ledger hardware wallets has led to reports of more than $86 million in crypto being drained from user wallets.

1. Onchain analysts estimate over $86 million stolen from hundreds of wallets tied to devices sold by Southeast Asian reseller CryptoBilis, but Ledger has not confirmed the figure or cause.
2. Current evidence points to tampered or counterfeit devices or exposed recovery phrases via that reseller, with no confirmation that Ledgers own infrastructure or firmware were breached.
3. The incident highlights hardware wallet supply chain risk and reinforces best practices like buying direct, controlling seed generation, and monitoring Ledgers ongoing investigation updates.

Deep Dive

1. What Happened And What Is Confirmed

Multiple outlets report that Ledger is investigating thefts affecting customers in Indonesia, Malaysia and the Philippines who bought devices from reseller CryptoBilis, after users reported drained wallets on X and Reddit. Ledger asked CryptoBilis to halt all sales and shipments while it investigates and told customers who purchased in the last 90 days not to initialize unused devices and to consider migrating funds to a new device with a new recovery phrase if already set up.

Onchain investigator Specter traced inflows from hundreds of wallets across Bitcoin, Ethereum and Tron, estimating total losses at more than $86 million, with Arkham data showing nearly $87 million including large ETH, BTC and USDT balances. These loss figures are based on third party onchain clustering and have not been independently verified by Ledger.

2. Likely Attack Vector And Scope

Reports suggest a localized issue around the CryptoBilis distribution channel rather than a confirmed global Ledger-device exploit. Analysts and media describe a plausible supply chain scenario in which devices are tampered with before delivery or come with recovery phrases already known to an attacker, which would let them sweep any funds later deposited.

Ledger has publicly said there is no evidence its core systems or services were compromised and that the investigation is focused on devices sold through that reseller. It also remains unclear whether all traced thefts are linked to CryptoBilis or whether some victims were hit by separate phishing or social engineering campaigns that exposed recovery phrases.

3. Takeaways For Hardware Wallet Users

This incident underlines that self custody removes exchange risk but does not remove supply chain, phishing or physical custody risk. Even with a reputable brand, compromised distribution or recovery phrases can defeat the security model.

Industry responses and prior incidents point to several structural safeguards: buying devices directly from the manufacturer or a highly trusted channel, treating any preprinted or prefilled seed phrase as unsafe, and never entering recovery phrases into websites, mobile apps or support chats. For now, the key things to watch are Ledgers formal incident report, any confirmation of the exact attack vector, and whether loss estimates continue to rise as more wallets are linked.

Conclusion

A large, still unconfirmed theft cluster tied to a Ledger reseller shows that the weakest link in self custody is often the distribution path or recovery phrase handling, not the hardware chip itself. How Ledger traces and discloses the attack vector will shape confidence in hardware wallets and may prompt tighter practices around sourcing, quarantining and initializing devices across the entire industry.