Crypto Hardware Wallets Hacked via Tampered Devices Sold by Authorized Reseller

Attack Details

A hardware wallet exists for one reason: to keep your crypto keys away from the internet. Someone apparently found a way around that promise before the box was even opened. Criminals stole $90 million of crypto by hiding password readers inside USB-like devices, according to the Financial Times.

The devices involved were Ledger hardware wallets. They were sold through CryptoBilis, an authorized reseller operating in Southeast Asia. The attackers did not target the blockchain or the wallet software. They reportedly went after the physical hardware itself, somewhere between the factory and the customer. How the attack reportedly worked Unauthorized hardware implants were reportedly added to devices sold through CryptoBilis, and they were placed there before the wallets reached buyers. The implants reportedly contained microcontrollers, which are small, cheap computer chips. Their job was to capture sensitive information shown on the wallet’s screen during setup. The prize was the 24-word recovery phrase. When you initialize a hardware wallet, it generates this list of words as a master backup.

Reactions from Regulators and Companies

Ledger has confirmed that at least one device was compromised. The company has also said the compromised devices are limited to those sold by CryptoBilis. Its guidance to customers is blunt. Anyone who bought a device from CryptoBilis within the past 90 days should not initialize it. That warning targets the exact moment the attack exploited. Setup is when the recovery phrase appears on screen, so skipping setup on a suspect unit keeps the implant from seeing anything worth stealing. Tether, the issuer of the USDT stablecoin, has frozen USDT linked to the compromised wallets. Stablecoins like USDT are issued by a central company, which means the issuer can block specific addresses from moving tokens.

Market Implications

Hardware wallets are built to survive attacks from the outside world. Malware on your laptop, phishing websites and compromised browser extensions are all threats the devices are designed to handle. A supply-chain attack changes the rules. If the device is altered before you touch it, every security feature downstream is working for the attacker, not for you. The CryptoBilis case also raises a question about authorized resellers. Buying from an official partner is usually the standard advice for avoiding tampered gear, yet these devices came through exactly that kind of channel.

Conclusion

For individual holders, the immediate checklist is short. Know where your device came from, and if it came from CryptoBilis in the past 90 days, follow Ledger’s warning and do not initialize it. There is a market dimension too. Frozen USDT addresses affect liquidity for the tokens involved and reinforce how much power centralized issuers hold during a crisis. The things to watch now are whether Ledger expands its list of affected devices and what measures will be taken to prevent similar attacks in the future.