Ledger, a leading manufacturer of cryptocurrency hardware wallets, is currently investigating a significant security breach that has led to the theft of approximately $93 million in digital assets. The incident centers on a supply chain attack involving devices sold through the Southeast Asian reseller CryptoBilis. Unauthorized hardware implants were discovered in some of these devices, enabling attackers to capture users’ recovery phrases and access their funds remotely.
Discovery of Unauthorized Hardware Implants
The breach was first identified on October 9, 2026, when multiple users reported unauthorized transactions draining their wallets. Upon investigation, Ledger confirmed that certain devices sold by CryptoBilis contained unauthorized hardware implants. These implants, equipped with cellular modules, intercepted users’ 24-word recovery phrases displayed during the initial setup process and transmitted them to external servers over LTE networks. This method allowed attackers to reconstruct private keys and access the associated cryptocurrency without physical possession of the devices.
Impact Assessment and Response
Blockchain analytics firms estimate that the attackers siphoned off approximately $93.2 million from 315 wallets across multiple blockchains, including Bitcoin, Ethereum, and Tron. In response, Ledger has halted all sales and shipments of hardware wallets through CryptoBilis and is collaborating with relevant authorities to investigate the source of the tampered devices. The company has also advised customers who purchased wallets from CryptoBilis in the past 90 days to refrain from initializing them and to transfer their assets to new, secure devices.
Broader Implications for the Cryptocurrency Hardware Industry
This incident underscores the vulnerabilities inherent in the cryptocurrency hardware wallet supply chain. Even devices purchased through authorized resellers can be compromised before reaching consumers. Ledger’s CTO, Charles Guillemet, acknowledged the industry’s susceptibility to such physical supply chain tampering and emphasized the need for enhanced security measures. The company is reviewing its sales policies and anti-tamper protections to prevent future incidents.
Recommendations for Cryptocurrency Users
Users are advised to purchase hardware wallets directly from manufacturers or their official channels to minimize the risk of tampering. It’s crucial to verify the integrity of the device upon receipt, including checking for any signs of physical modification. Additionally, users should be cautious of phishing attempts and ensure they only use official software and websites when managing their cryptocurrency assets.
Looking Ahead
As the investigation into this supply chain attack continues, Ledger is committed to strengthening its security protocols and collaborating with industry partners to enhance the overall safety of cryptocurrency hardware wallets. Users are encouraged to stay informed through official Ledger communications and to follow best practices for securing their digital assets.
