Hardware wallet probe follows $93M crypto theft

TLDR

Investigators are probing a major hardware wallet supply chain attack, after compromised Ledger devices from a Southeast Asian reseller were linked to roughly $93 million in stolen crypto.

1. Blockchain analysis suggests about $93 million was drained from hundreds of wallets on multiple chains, with losses concentrated on TRON, Bitcoin and Ethereum.
2. Ledger found at least one device with an unauthorized hardware implant and says the incident appears confined to reseller CryptoBilis, not its own infrastructure or direct sales.
3. The probe highlights that cold storage is only as safe as the hardware supply chain, making provenance, seed handling, and official channels critical for self?custody users to watch.

Deep Dive

1. Scale And Mechanics Of The Theft

Reports from blockchain intelligence firms and media estimate roughly $93.2 million was taken from around 315 wallets across TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana, using prices from 9 Oct when the main drains began, with TRON alone accounting for about $70.5 million and Bitcoin $16.8 million. TokenPosts summary and other coverage note that Tether has frozen around $10 million in USDT tied to the thefts, and additional USDC may be flagged.

Investigators link the affected wallets to devices sold through CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia and the Philippines, and are still reconciling different loss tallies, which range from the high $80 millions to over $93 million. Estimates remain unofficial until Ledger and law enforcement publish their findings.

2. What The Hardware Wallet Probe Is Finding

Ledger has confirmed that at least one customer device contained an unauthorized hardware implant, providing concrete evidence of physical tampering in the wallet supply chain, but it has not yet proven that this implant caused every theft or how many devices are affected. In multiple updates, the company says its security infrastructure, systems and services, and devices sold directly, show no signs of compromise, and that confirmed cases are tied to CryptoBilis-sourced devices only.

Technical analyses referenced by Ledger and independent researchers describe small boards with cellular capabilities, connected to display or data lines, potentially able to capture the 24?word recovery phrase shown during setup and transmit it, though this behavior is not fully verified in every device. A separate claim about a tampered device bought from European retailer MediaMarkt remains unconfirmed, and Ledger has not extended the incident to Europe in official statements.

3. Implications For Self?Custody Users

The incident shows that hardware wallets are only as trustworthy as their chain of custody: if a reseller or shipment is compromised, an attacker may know the seed phrase from day one, turning cold storage into a delayed drain. Ledger has asked CryptoBilis to halt hardware wallet sales and has told affected customers to migrate funds to a new device with a freshly generated recovery phrase, using official support channels only, as reported in Crypto.news coverage.

For self?custody users more broadly, the case elevates supply chain and phishing risks together (a fake Ledger website is already targeting seed phrases), reinforcing long-standing guidance to buy from verified vendors, treat prefilled or externally supplied seed phrases as compromised, and never enter a recovery phrase into any website or unsolicited app.

Confidence: moderate because loss estimates and device counts are still being refined in an ongoing investigation.

Conclusion

The hardware wallet probe now underway follows a highly coordinated theft where compromised reseller devices appear to have fed attackers recovery access to roughly $93 million across several chains. For crypto users, the lesson is that self?custody security depends not just on owning a hardware wallet, but on trusting its origin, protecting the seed phrase, and watching official manufacturer communications during any supply chain scare.