Ledger probes $93M hardware wallet drain

TLDR

Ledger is investigating a hardware wallet security incident that appears to have drained roughly $90 million from users who bought devices through a Southeast Asian reseller.

1. On chain analysts estimate about $9093 million stolen across hundreds of wallets on multiple networks, but Ledger has not confirmed a final loss figure.
2. Evidence points to tampered devices sold by reseller CryptoBilis, including at least one Ledger with an unauthorized hardware implant, while Ledger says its core systems show no signs of compromise.
3. The highest risk appears to be users who recently bought Ledger devices from CryptoBilis, and the broader lesson is to treat hardware sourcing and seed handling as critical attack surfaces.

Deep Dive

1. Scale And Pattern Of The Drain

Multiple investigators report a large, coordinated wallet drain tied to Ledger users in Indonesia, Malaysia and the Philippines who purchased devices via reseller CryptoBilis. Bitquery estimated about a 92.9 million dollar wallet drain across 311 wallets on Bitcoin, Ethereum, TRON, BNB Chain and Polygon, while other analyses put suspected losses between 72 million and 93.4 million dollars across hundreds of addresses, with heavy exposure on TRON and significant amounts in Bitcoin and Ether.

TokenPost reports that around 315 wallets were affected, with roughly 70.5 million dollars on TRON, 16.8 million dollars in Bitcoin and 3.7 million dollars on Ethereum, and that Tether froze about 10 million dollars of USDT linked to the incident. These numbers are still independent estimates and Ledger has explicitly not verified a final loss total.

Confidence: moderate because on chain estimates are detailed but not yet reconciled or confirmed by Ledger.

2. Suspected Supply Chain Attack

Ledger states there is no indication that its security infrastructure, systems or services were compromised, and that the incident appears tied to devices distributed by CryptoBilis, an authorized reseller in Southeast Asia. Several reports describe a likely supply chain attack, where devices were tampered with or counterfeited before reaching customers, which is different from a remote software exploit on genuine devices.

In a key development, Ledger confirmed that one impacted users hardware wallet contained an unauthorized hardware implant, strengthening suspicions of physical tampering linked to CryptoBilis inventory. Independent reporting describes a modified Ledger Nano X with a concealed module capable of intercepting recovery phrases during setup, although investigators have not yet proven that all affected users received similarly modified devices or that this implant directly explains every loss.

3. Who Is Affected And What To Watch

According to several reports, Ledger asked CryptoBilis to pause all sales and shipments and advised customers who bought devices from the reseller within the last 90 days not to initialize unused devices. For users who had already set them up, Ledger suggested moving funds to a new Ledger signer created with a new seed phrase. The incident currently appears concentrated in Southeast Asia customers who used this distribution channel rather than global Ledger users.

On chain, some stolen funds have been frozen in USDT, while other portions were swapped into USDD or routed through mixers and privacy tools such as Tornado Cash and Zcash, which complicates recovery. The key things to watch now are an official Ledger postmortem, a reconciled loss total, any confirmation of how many devices were implanted, and whether regulators or law enforcement name the actors involved.

Conclusion

Ledgers probe into the roughly 90 million dollar hardware wallet drain points toward a targeted supply chain compromise at a regional reseller rather than a global failure of Ledgers core systems. For crypto users, the practical takeaway is that self custody only delivers its promised security when the hardware, supply chain and seed handling practices are all trustworthy, so sourcing devices carefully and monitoring official updates around this investigation will be critical.