Hardware wallet reseller exploit drains $93.2M

TLDR

A suspected supply chain attack at Ledgers Southeast Asian reseller CryptoBilis has led to roughly ninety million dollars in multi?chain wallet drains, with the exact figure still unconfirmed.

1. Reports suggest about $93 million was drained from 300 to 470 wallets linked to devices sold by CryptoBilis, with estimates clustered between $86 million and $93.4 million.
2. Ledgers own systems have not been shown compromised, but one customer device contained a hidden hardware implant, pointing to tampered or counterfeit units in the resellers channel.
3. The main practical implications are supply chain risk and seed phrase safety, especially for anyone who recently bought hardware wallets from third?party resellers.

Deep Dive

1. Scope Of The Losses

Multiple investigations describe a large multi?chain wallet drain affecting customers in Indonesia, Malaysia and the Philippines who bought Ledger devices from reseller CryptoBilis. TokenPost reports a $93.2 million drain across 315 wallets, with Tron, Bitcoin and Ethereum bearing most of the loss.

Independent estimates vary: some on?chain analysts quote $72 million to $86 million, while others such as Yfarmx and Bitquery cluster near $92.9 million to $93.4 million across hundreds of addresses. Ledger has not yet confirmed a definitive total, but the order of magnitude is clear. Tether reportedly froze about $10 million in USDT tied to suspected attacker wallets to limit further movement.

2. How The Attack Likely Worked

Ledger says there is no indication that its core infrastructure or Secure Element design was breached, and the issue appears localized to devices distributed through CryptoBilis. Several reports describe a suspected supply chain compromise, where devices were physically modified or replaced before reaching customers.

Bitcoin.com and others note that Ledger confirmed one affected users device contained an unauthorized hardware implant. Former Mt. Gox CEO Mark Karpels showed a Nano X with a hidden module under the screen padding, apparently capable of capturing recovery phrases during setup and exfiltrating them via cellular components. Investigators have not yet proven that all victim devices had similar implants or that this is the sole cause of the thefts.

3. Practical Implications For Users

Ledger asked CryptoBilis to halt sales and shipments and advised customers who bought from that reseller in the past 90 days not to initialize unused devices and to consider migrating funds to a new device with a new seed phrase. Finbold summarizes this precautionary guidance in its incident recap.

Broader lessons apply beyond this case: buying hardware wallets only from official channels, treating third?party resellers as a higher?risk path, and never reusing recovery phrases on new devices all reduce exposure to supply chain attacks. Users should also remember that genuine vendors will never ask for their full 12 or 24?word seed.

Conclusion

This incident highlights that hardware wallets are only as trustworthy as the path they take to your hands and the secrecy of your recovery phrase. While current evidence points to a reseller?level compromise rather than a direct Ledger infrastructure breach, the losses are large enough that investigators findings and any new anti?tampering measures will be important signals for anyone relying on hardware self?custody.