Crypto Under Siege: Organized Crime Unleashes Multi-Million Dollar Attack on Hardware Wallet Users
Ledger has revealed details of a 'sophisticated attack' involving tampered hardware wallets sold through compromised supply chains, leading to an estimated $86 million in customer losses. The company states the attack targeted its distribution channels, not its core technology, and is now working with law enforcement to dismantle the criminal operation.
Ledger, a prominent hardware wallet manufacturer, has released a statement addressing reports from customers regarding loss of funds and tampered devices, characterizing it as one of the most “sophisticated attacks” the digital asset industry has ever faced. The company confirmed that a “highly organized criminal group” orchestrated an elaborate scheme, purchasing Ledger devices, installing implants capable of reading users’ seedphrases, and subsequently reintroducing these compromised devices into the supply chain through various resellers.
The initial reports emerged from customers in South East Asia who had purchased devices from a Malaysia-based reseller, CryptoBilis, and subsequently lost funds. Ledger launched an investigation, which ultimately confirmed that at least one of the impacted users’ devices contained an unauthorized hardware implant. While Ledger has not disclosed the exact monetary losses, blockchain investigator Specter estimated that approximately $86 million had been drained from wallets due to these tampered devices.
In its official statement, Ledger clarified that the attack did not exploit any flaws in its chip, operating system, or servers, and asserted that its internal systems remained uncompromised. Instead, the company stated, “This was an attack on the distribution channel after the devices left our control.” Ledger elaborated on the criminal group’s extensive preparations, noting they “built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets.”
As part of its “largest investigation to date,” Ledger dispatched employees to other markets, including Europe, to verify the integrity of other supply chains. The company reported that screened devices in these regions were clean, and that authorized resellers and distributors in Southeast Asia and Hong Kong have proactively suspended sales. Ledger also confirmed its collaboration with law enforcement agencies to “follow the funds and dismantle the attackers’ infrastructure,” though the exact number of targeted customers remains unclear from its statement.
This incident adds to a series of security challenges plaguing the crypto industry. Earlier in July, hackers successfully stole nearly $120 million in bitcoin from Coldcard users. Furthermore, Ledger itself has been targeted in previous data breaches this year, with scammers attempting to acquire customer information via the company’s payment processor, Global-e, highlighting the persistent and evolving threats within the digital asset ecosystem.