Ledger Investigates $86 Million Crypto Theft Tied to Tampered Reseller Hardware

Hardware cryptocurrency wallet maker Ledger is investigating a supply chain attack after reports surfaced that hundreds of user accounts were drained of more than $86 million in digital assets, according to reporting by The Verge (https://www.theverge.com/tech/1009294/ledger-wallet-tampering-suspected-after-reports-of-crypto-thefts).

The theft has been linked to physically altered hardware distributed by third-party reseller CryptoBillis, primarily affecting customers located in Southeast Asia. Ledger confirmed that an examination of one affected customer device revealed an unauthorized hardware implant. The company has asked CryptoBillis to halt all sales of Ledger devices while the inquiry continues.

Images and video footage shared across X and Threads show a compact circuit board placed beneath the device's display screen. The illicit module intercepts data shown on the display during the initial setup process, including the generated recovery seed passphrase. An embedded SIM card within the implant then transmits the captured passphrase to attackers, allowing them to remotely access and transfer funds out of the wallets.

There is no indication that Ledger's internal systems or direct manufacturing operations were compromised, nor that devices bought directly from Ledger were impacted. The incident appears isolated to the third-party distribution chain involving CryptoBillis.

Ledger has issued guidance to help users verify device integrity and check whether their hardware has been subjected to physical tampering.