Hardware wallets face $93M supply-chain theft

TLDR

A large theft tied to tampered Ledger hardware wallets sold through a Southeast Asian reseller has led analysts to estimate around $93 million drained in a supply-chain style attack.

1. Ledger confirmed an unauthorized hardware implant in at least one customer device from reseller CryptoBilis, while blockchain analysts estimate around $93 million stolen but Ledger has not verified the total.
2. Current evidence points to wallets bought through CryptoBilis in Southeast Asia, exposing serious hardware-wallet supply-chain risk even though Ledgers own systems and direct sales channels appear unaffected.
3. Crypto users should review where their devices came from, how their seed phrases were generated, and watch for further official guidance and industry changes to reseller controls and anti-tampering measures.

Deep Dive

1. Confirmed Facts And The $93M Figure

Ledger has confirmed that at least one affected hardware wallet purchased through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, found during a drain investigation involving missing funds from multiple users. Ledger says its infrastructure and devices sold directly by the company have not been compromised and is working with law enforcement and impacted customers.

Blockchain analytics firm Bitquery independently estimated about $92.9 million removed from 311 wallets across Bitcoin, Ethereum, TRON, BNB Chain and Polygon, a figure that aligns with other reports of losses in the 86 to 94 million range, though none of these totals have been formally confirmed by Ledger yet.

Confidence: moderate because the implant and reseller link are confirmed, but loss estimates and exact victim counts remain third party and unverified.

2. Who Is Affected And What The Supply-Chain Attack Looks Like

So far, all confirmed draining cases involve Ledger devices sold through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia and the Philippines, and CryptoBilis has halted all hardware wallet sales during the investigation. Ledger describes the scope as limited and reiterates that its own systems and direct sales are not affected, but it has not yet disclosed how many devices may carry implants.

Investigators and independent researchers report small circuit boards with cellular capabilities hidden behind the wallet screen, designed to capture the 24-word recovery phrase shown during setup and transmit it remotely, which would allow attackers to rebuild the wallet on another device and move funds without physical access. There are unconfirmed reports of a possibly tampered Ledger purchased from MediaMarkt in Europe, but Ledger has not validated that claim and community examination of images is inconclusive, so the geographic spread beyond Southeast Asia is still uncertain.

3. Practical Steps And Signals To Watch

Ledger has advised customers who bought devices through CryptoBilis not to initialize unused wallets, and those who already set them up to consider moving assets to a new signer generated on a fresh device with a brand new recovery phrase. Security researchers and community voices are stressing long standing best practices for all hardware wallets: always buy from official channels, never accept or use a pre-filled seed phrase, and never type your seed into a website or app.

Going forward, key signals to watch are: more precise loss figures and victim counts, any confirmation or refutation of cases outside Southeast Asia, whether additional vendors or resellers are implicated, and how quickly manufacturers tighten reseller verification, ban reselling returned devices, and add hardware level protections against implants.

Conclusion

This incident shows that hardware wallets are only as secure as their supply chains and seed handling, with a single compromised reseller channel potentially leading to tens of millions of dollars in losses. Until investigations conclude and the industry strengthens anti-tampering and reseller controls, crypto users should treat device origin and seed generation as critical risk factors and adjust their self-custody habits accordingly.