Ledger ties $93M thefts to tampered wallets

TLDR

Ledger has linked a major theft of user funds to tampered hardware wallets sold through a Southeast Asian reseller, with outside estimates putting losses near $93 million.

1. Investigators found unauthorized hardware implants in at least one Ledger device from reseller CryptoBilis, while blockchain firms estimate roughly $9294 million stolen across hundreds of wallets.
2. The suspected attack captures users recovery phrases via hidden cellular-enabled chips, highlighting supply-chain risks even when Ledgers own infrastructure appears uncompromised.
3. Key unknowns include the true loss total and global scope, and users are re-evaluating how and where they buy hardware wallets and generate seed phrases.

Deep Dive

1. What Ledger Has Tied To The Thefts

Ledger confirmed that a customer device bought through its authorized Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, the first concrete proof of physical tampering in the case. The company says all confirmed theft cases so far involve devices purchased from CryptoBilis and that its own systems and direct sales channels show no compromise, but it has not yet confirmed how many devices are affected or the exact loss total.

Independent blockchain analyses by firms such as Bitquery put suspected losses around $93 million, across more than 300 wallets on Bitcoin, Ethereum, TRON, BNB Chain and Polygon, with some funds routed through mixers and about $10 million in USDT reportedly frozen in response. Ledger has acknowledged these outside estimates but stopped short of endorsing a precise figure, keeping the headline number in the low-90-million range as a working estimate rather than an official total.

Confidence: moderate because tampering evidence and loss estimates are well-sourced, but Ledger has not yet published a final, audited figure.

2. How The Attack Likely Worked And Why It Matters

Technical analyses describe small circuit boards hidden behind the Ledger devices screen, with cellular hardware designed to capture and transmit the 24-word recovery phrase shown during setup. Since a recovery phrase is the master key to a wallet, an attacker who knows it can reconstruct the wallet elsewhere and drain funds without touching the original device. Some reports suggest the implant tapped screen communication lines rather than breaking into the secure element, meaning the chip could steal secrets even while the core cryptographic hardware remained intact.

This is a classic supply-chain attack: the device appears new and sealed, but is already compromised before the user ever powers it on. For crypto users who treat hardware wallets as vaults, the incident shows that trust must extend beyond the brand to the physical distribution path and how the seed phrase is generated and stored.

3. What To Watch Next And Practical Safeguards

Several questions remain open: how many devices carry implants, whether every theft used the same hardware trick, and whether reports of tampered wallets at European retailers reflect the same attack or separate incidents, which Ledger has not confirmed. More precise loss figures and any law-enforcement actions could change how regulators and manufacturers treat hardware wallet supply chains.

Ledger has advised customers who bought through the affected reseller not to initialize unused devices, and for those already set up, to consider migrating funds to a new device with a newly generated recovery phrase, never reusing a potentially exposed seed. More broadly, common safeguards include buying only from official or clearly authorized channels, rejecting any wallet that arrives with a pre-filled recovery phrase, and treating any request to type a seed phrase into a website or app as a red-flag phishing attempt.

Risk: physically tampered devices can look normal yet silently leak seed phrases, so drains may occur days or weeks after setup even if everything initially appears fine.

Conclusion

Ledgers investigation shows that the biggest risk in hardware wallets right now is not the cryptographic chip, but the supply chain and handling of recovery phrases. A sophisticated implant-based attack appears to have stolen tens of millions of dollars by turning compromised devices into seed phrase siphons. Until the full scope is known, crypto users who rely on hardware wallets can reduce exposure by focusing on how they source devices and generate their recovery phrases, and by monitoring official Ledger updates for any expansion of the affected reseller network or guidance on additional checks.