Cryptocurrency investors have lost an estimated $90 million after criminals secretly modified hardware wallets manufactured by Ledger, exposing a significant vulnerability in the supply chains used to distribute devices designed to protect digital assets from online theft.
The French cryptocurrency security company confirmed that genuine Ledger devices had been physically tampered with before reaching customers, allowing attackers to capture sensitive recovery information during wallet setup. The compromised products were distributed through CryptoBilis, a Malaysia-based reseller, in an operation that involved concealed electronic components and months of preparation.
Investigators discovered unauthorised hardware implants capable of reading the recovery phrases displayed during device activation and transmitting that information through cellular connections. These phrases, typically consisting of 24 words, allow users to restore access to their cryptocurrency holdings if their original device is lost or damaged. Anyone obtaining them can potentially gain control of the associated assets without possessing the hardware wallet itself.
The attack exploited a fundamental weakness in cryptocurrency self-custody. Hardware wallets are designed to keep private signing keys isolated from internet-connected systems, reducing exposure to conventional online attacks. However, that protection depends on customers receiving devices that have not been physically altered, particularly during the initial process of generating and recording recovery credentials.
The criminals reportedly purchased authentic Ledger products, installed custom-built components and returned the modified devices to distribution channels. They also established infrastructure to collect stolen credentials and transfer cryptocurrency from affected wallets, enabling a coordinated theft operation after customers had unknowingly activated the compromised devices.
The estimated losses have been reported at approximately $90 million, although assessments vary and the final amount remains subject to confirmation. The incident has raised concerns about the scale of organised cryptocurrency crime and the difficulty of recovering assets once unauthorised blockchain transactions have been completed.
Ledger maintains that its internal systems, secure elements and operating software were not compromised. The company attributes the attack to interference with devices after they had left its direct control, making reseller security and product handling central issues in the investigation.
CryptoBilis has suspended Ledger device sales and shipments while cooperating with the investigation. Ledger is reviewing its distribution arrangements and strengthening restrictions on the resale of returned products, while rival manufacturer Trezor has also increased scrutiny of its reseller network.
For cryptocurrency investors, the financial implications extend beyond the immediate losses. Self-custody allows individuals to control digital assets without relying on an exchange, but it also places responsibility for protecting recovery credentials and verifying device integrity on the owner. Unlike conventional bank payments, confirmed cryptocurrency transfers generally cannot be reversed through a routine customer dispute process.
The incident also creates commercial challenges for hardware wallet manufacturers, whose products depend on customer confidence in physical security as well as encryption. Stronger distributor verification, anti-tampering measures and restrictions on returned devices could increase operating costs, but failures in these areas may expose customers to substantial financial losses.
For financial institutions and investment managers considering digital asset custody, the attack reinforces the importance of assessing third-party suppliers and the full chain of control over security equipment. Technical safeguards offer limited protection when criminals can interfere with products before they reach their intended users.
The theft demonstrates that cryptocurrency security cannot be measured solely by the strength of its underlying technology. As digital asset ownership expands, manufacturers, distributors and investors must also address the financial risks created when trusted hardware passes through vulnerable supply chains.
