Tampered Ledger wallets drained of up to $100M in supply-chain attack
Hardware wallet maker Ledger confirmed a supply-chain tampering attack tied to a Southeast Asian reseller, where attackers implanted hidden cellular chips inside authentic devices to intercept recovery phrases and drain crypto wallets.
Crypto users who purchased Ledger hardware devices through Southeast Asian authorized reseller CryptoBilis have been targeted in a hardware tampering attack, resulting in estimated losses ranging from $70 million to more than $100 million across multiple blockchains. The Financial Times described the breach as one of the most sophisticated attacks the industry has witnessed, reporting that criminals concealed password readers inside USB-like devices to drain approximately $90 million in digital assets.[1][3][4][7][11]
According to discussions on the Uneasy Money podcast, attackers purchased genuine Ledger devices, installed an LTE chip paired with an eSIM inside, and returned them into the reseller supply chain. When buyers initialized the devices, the hidden implant copied the 24-word seed phrase directly from the display and transmitted it over cellular networks. Because the secure chips and firmware were untouched, the modified wallets still appeared normal and passed Ledger's genuine verification check.[4][6][7][8][10]
Among the victims was an alleged crypto scammer who lost roughly 60 Bitcoin—valued at approximately $4.8 million—after his wallet was compromised, according to blockchain analytics firm Chainalysis. Decrypt reported that those specific lost funds had been generated from a task scam that paid victims to generate fake product sales and reviews before demanding upfront deposits to release payouts.[2][5][12]
Blockchain tracing service Bitquery tracked around $102 million across 324 compromised wallets, though Ledger has not independently verified that total. Emergency response group SEAL 911 identified the unauthorized drains from victim reports and assisted Tether in freezing $10 million linked to the incident, while Ledger cautioned that users migrating an already-compromised recovery phrase to another hardware device will remain vulnerable.[6][8][9][10]
Key facts
- Attackers tampered with authentic Ledger hardware wallets distributed by authorized reseller CryptoBilis in Southeast Asia.
- A covert LTE chip and eSIM inside modified devices intercepted 24-word recovery phrases during setup and broadcast them over cellular networks.
- The implanted devices successfully passed Ledger's built-in genuine verification checks because internal secure chips and software were not altered.
- Total estimated losses span between $70 million and $102 million across hundreds of compromised wallets, according to various estimates.
- Chainalysis reported that an alleged crypto scammer lost approximately 60 BTC ($4.8 million) stemming from a fake-review task scam to the tampered devices.
- Tether froze $10 million in stolen funds with assistance from SEAL 911 following victim reports.
- Ledger warned that importing the compromised seed phrase into another hardware wallet will not secure the user's funds.
Sources · 10 sources
- LS
Laura Shin@laurashinPost on X ·
Users who bought @Ledger devices through one Malaysian reseller were drained of an estimated $100M+ across six chains. 🔓 @perkinscr97 says it may be time to want an intermediary, while @austincampbell argues the real issue is how people model security. 🔐 https://t.co/EYlrjtrCjZ
Open source - BS
BSCN@BSCNewsPost on X ·
Ledger Hack Costs Alleged Crypto Scammer $4.8M An alleged crypto scammer has reportedly lost $4.8 million in Bitcoin after his Ledger wallet (@Ledger) was compromised. The victim reportedly lost around 60 bitcoin:native in the incident. The breach is tied to a wider attack involving tampered Ledger devices distributed by CryptoBilis. Investigators have linked the broader attack to hundreds of affected wallets. Source: Chainalysis
Open source - FT
Financial Times@FTPost on X ·
It has been described as 'one of the most sophisticated attacks' the crypto industry has seen. https://t.co/nSwMaMPILN https://t.co/f3tomtwnH9
Open source - LS
Laura Shin@laurashinPost on X ·
How a Hidden LTE Chip Turned Real Ledgers Into Seed Phrase Thieves: Uneasy Money A Ledger reseller's devices shipped with an LTE chip and eSIM wired inside that allowed bad actors to drain $70M to $100M. 🔐 On Uneasy Money, @tayvano_ tells @kain and @austingriffith how the implant passed @Ledger's genuine check, and why panicked owners are now the bigger risk. 📡 Timestamps: 🎬 00:00 Intro 🔐 01:32 Why a Ledger reseller became the entry point for a supply chain attack 📡 09:15 Taylor on how the CryptoBilis attack moved past fake devices and scratchers 🧯 19:01 Why Taylor says panicked Ledger owners now face the bigger risk 💸 20:17 Why Austin sees DIY hardware wallets as the future 🕵️ 30:34 How Taylor “demixed” Zcash by following the gas trail 📣 34:52 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://t.co/AomksPiXwt 🎙️ 35:37 What the bug planted in OpenAI's office says about AI espionage 🛠️ 41:42 Austin's homemade Alexa, blood wallet, and AI-run electronics bench 🪙 48:04 Why a decade-old XRP infinite mint bug points to AI-assisted hunting 🧮 51:04 Is $250K enough? Taylor compares the XRP bounty to Google's Chrome payout ⛓️ 01:00:30 StarkNet wants to become an L1: why Kain thinks that's where L2s end up 🏚️ 01:11:03 How MegaETH shows why L2 ecosystems struggle to keep their apps
Open source - DE
DecryptArticle ·
Scammer Lost $4.8M in Bitcoin to Tampered Ledger Wallets: Chainalysis The funds came from a task scam that paid people to fake product sales and reviews, then demanded deposits before releasing their pay.
Open source - SN
Saanjana Nikita@Saanjana_NikitaPost on X ·
ledger's chips weren't hacked the problem was who sold the wallets attackers bought real ledgers, slipped a tiny hidden part inside, and returned them. the devices got resold to buyers in southeast asia during setup, that part copied the 24-word recovery phrase and sent it out through a built-in SIM. the chip and software were never touched, so everything looked normal bitquery traced around $102M across 324 wallets. ledger hasn't confirmed that yet, so treat it as an estimate this isn't really a "ledger is unsafe" story. it was one reseller channel but a hardware wallet is only as safe as the path it took to reach you. buy straight from the maker, and if the box looks opened or setup feels off, stop the supply chain is part of your security too.
Open source - CR
CryptoSlateArticle ·
Who opened your crypto wallet before it reached your hands? In early October, customers in Southeast Asia discovered that their crypto had disappeared from Ledger hardware wallets that still seemed to be working normally. They bought the devices through CryptoBilis, an authorized reseller, and believed their private keys were protected inside a device built for that purpose. What they couldn't see was a second piece… Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Open source - LS
Laura Shin@laurashinPost on X ·
How a Spy Implant Turned Ledger's Authorized Resellers Into an Attack Vector "They spent months of research and development building this." 🛠️ @MagicalTux on the spy implants that stole $100 million from @Ledger devices, plus @tanuki42_ on how @SEAL_911 spotted the drains and helped freeze $10M. 🎧 Timestamps: 🎬 00:00 Intro 🚨 03:50 How Jonty spotted the Ledger drains through SEAL 911 victim reports 📡 05:52 How the implant reads a 24-word seed phrase and sends it out by eSIM 🛫 11:33 Mark on the spy implant he found in a Ledger Flex bought in Singapore 🕵️ 15:16 CryptoBilis or a distributor? Mark and Jonty on who could be behind it 📣 17:38 Nexo: Generate daily interest on your crypto or borrow against your assets at https://t.co/AomksPiXwt 🇪🇺 18:19 MediaMarkt and Aqipa: has the Ledger implant reached Europe? 🛒 27:00 Buying direct vs. through a reseller, and why Vietnam needs resellers 🔐 31:30 Ledger's 'tamper-proof' notice and whether self-custody is dead 🔧 36:45 Mark opens a Nano X on camera to show how to check for an implant 🧊 40:33 Tether's $10M freeze and why Jonty says recovery could take years
Open source - BA
Bankless@BanklessPost on X ·
WEEKLY ROLLUP: The Crypto Bull Market Just Got a Reality Check Uptober has turned into Redtober. @RyanSAdams and @TrustlessState unpack crypto’s selloff, why the early bull market may still be intact, and how inflation and AI debt fears are rattling markets. Plus, Ledger’s $102M supply-chain attack, Bank of America’s $5B scandal, and Richard Heart’s arrest. [TIMESTAMPS] 0:00 Intro 0:09 Redtober: Crypto Selloff & Early Bull - @tulipking 10:38 Hot Inflation & AI Market Risks - @KobeissiLetter 19:55 Ray Dalio's Debt Warning 26:23 Ledger's $102M Supply-Chain Attack - @Ledger_Support - @MagicalTux 31:34 France's Crypto Wallet Reporting Proposal - @alistairmilne 34:52 Bank of America, CZ & Debanking - @cz_binance - @nic_carter 41:15 Richard Heart Arrested - @BitcoinNewsCom - @ercwl - @TrustlessState 48:43 PaperTrade's 1,000x Leverage Game - @papertrade_xyz 53:28 @solana Upgrades & @Starknet's Layer 1 Vote 57:52 @NEARProtocol Foundation & @AskVenice AI Growth - @TheBlockCo - @sabrinaesaquino
Open source - CR
CryptoSlate@CryptoSlatePost on X ·
Ledger says a hidden implant copied recovery words from a wallet’s screen while its protected chip stayed intact. Moving the same recovery phrase to a new device keeps the wallet exposed. Analysis by @andjelaradmilac https://t.co/JeZ9BFSiUn
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
WuBlockchain Weekly: Ledger Hardware Wallets Hit by Tampering Attack, Solana Prepares Major Upgrade, US CPI Tops Expectations Ledger confirmed a hardware tampering attack involving a Southeast Asian reseller, Solana scheduled its Alpenglow mainnet upgrade targeting 150ms finality, and US inflation rose to 3.7%, above expectations. This week also saw a UK court ruling involving 61,000 BTC, new crypto regulations in Australia, and BitMine's ETH holdings nearing 5% of total supply.
Open source - DE
Decrypt@DecryptMediaPost on X ·
Scammer Lost $4.8M in Bitcoin to Tampered Ledger Wallets: Chainalysis https://t.co/5cgK6fH2Dc
Open source