What the Investigation into Compromised Ledger Wallets Revealed
Earlier this month, the crypto industry was rocked by a massive asset theft affecting a wide range of Ledger hardware wallets. According to estimates made by blockchain analysts, total losses ranged between $86 million and $93 million. Cold hardware wallets have always held a reputation as the safest way to store digital assets. However, cases like this serve as a stark reminder that no system is 100% immune.
While the underlying technology itself remains secure — and the manufacturer confirmed there were no vulnerabilities in the Ledger system — the scale and speed of this breach prompted a centralized investigation. After obtaining several compromised devices directly from users, Ledger uncovered the exact scheme used by the attackers.
Let’s look closer on what actually happened.
Details of the Ledger Incident
It all began on October 9, when attackers drained funds from more than 300 crypto wallets across five networks in just 47 minutes. All affected cases involved Ledger hardware wallets purchased from a Malaysian reseller, CryptoBilis.
Although the seller distributes devices across Southeast Asia and is an official reseller, Ledger confirmed the very next day that at least one unit bought from CryptoBilis contained a malicious third-party chip. Suspicion initially fell on the reseller itself. However, just a couple of days later, a European user in Germany purchased a similarly compromised device from MediaMarkt, which had arrived via another company — Austria's Aqipa. This pointed to a much broader supply-chain attack.
Tether also played a role in the fallout, managing to freeze roughly $10 million in USDT associated with the attackers' addresses; the remaining funds were quickly dispersed via cross-chain bridges and mixers.
Despite initial doubts, Ledger confirmed that its core architecture was never breached: the Secure Element chip and firmware were entirely untouched.
Instead, the attackers planted unauthorized hardware implants inside the devices to gain access to seed phrases. The criminal group purchased genuine hardware wallets, opened them up, and soldered a custom micro-board — featuring a microcontroller, eSIM, and LTE module — directly beneath the display screen. The modified devices were then fed back into retail distribution channels through smaller intermediaries.
When a buyer set up their new device, the hidden board captured the seed phrase directly from the screen and button presses, transmitting the data back to the attackers over a cellular network. Armed with the seed phrases, the threat actors immediately transferred the assets to their own wallets.
From the outside, the tampered wallets were completely indistinguishable from original units. Even Ledger’s built-in cryptographic attestation check passed successfully because the factory Secure Element remained intact. Detecting the modification required physically opening the casing — something average users rarely do — making the breach virtually impossible to spot during standard setup.
What the Investigation Uncovered
Buyers who purchased through CryptoBilis took the brunt of the attack, bearing the vast majority of the thefts. Ledger described this as the largest investigation in its history, stating that the group poured millions into logistics, hardware preparation, and money laundering infrastructure.
As a result, Ledger wallet sales have been suspended across six Southeast Asian countries and Hong Kong. Authorized resellers have also been prohibited from placing units on open display shelves or reselling returned devices.
In an ironic twist, data from Chainalysis revealed that one of the largest individual victims was a scammer who lost roughly $4.8 million — funds previously stolen through fake “online job” schemes.
Nevertheless, everyday users lost substantial sums that are virtually impossible to recover. Ledger advises against activating any devices purchased from CryptoBilis and strongly urges users who have already set them up to transfer their assets to safe locations immediately. Financial compensation is not provided in cases like this, highlighting one of the major drawbacks of non-custodial storage.
The Bottom Line
Ultimately, the crypto space continues to blend speed and relative anonymity with systemic vulnerabilities for end users. Buyers trusted a prominent brand with a stellar reputation, only to fall victim to a sophisticated supply-chain attack. While blame rests solely on the criminal group responsible, their identity remains unknown, leaving it unclear whether those behind the exploit will ever face justice.
