Ledger Wallets Hit by Sophisticated Supply Chain Attack Draining Millions in Bitcoin

Attack on Ledger Devices

A wallet holder described in a post on X as a crypto scammer lost over 60 BTC, worth $4.8 million, after a Ledger hardware wallet was compromised. The loss was not a one-off. It sits inside a much larger supply-chain attack on Ledger devices sold through CryptoBilis, a Southeast Asian reseller.nnn

How the Attack Worked

Ledger confirmed it found an unauthorized hardware implant inside at least one affected device. The implant captured the 24-word seed phrase users wrote down during setup. It then sent those phrases out over cellular networks. A seed phrase is the master key to a wallet. Whoever holds it can rebuild the wallet anywhere and move every coin inside.nnn

The Numbers Keep Moving

Early loss estimates ranged from $72 million to $86 million. Those figures were later revised upward to between $93 million and $102 million across roughly 300-plus wallets. Analysts tracking the collector addresses saw inflows in Bitcoin, Ethereum, TRON and stablecoins. Over 324 wallets were involved, per the research findings.nnn

Tether Freezes $10 Million

Tether froze about $10 million in USDT linked to the exploited addresses.nnn

Ledger Points to the Reseller

Ledger said every verified case traced back to purchases from CryptoBilis. The company stated that its own systems and direct sales channels remained secure. CryptoBilis temporarily paused sales after the discovery.nnn

The Perpetrators

Ledger characterized the perpetrators as a highly organized criminal group. According to the company, the group spent considerable effort building the implants before launching a coordinated strike.nnn

The Attackers' Strategy

The attackers did not drain wallets the moment seed phrases came in. Instead, they appear to have waited while victims loaded funds, then struck many wallets almost simultaneously. This approach maximizes the haul and minimizes warning. If the group had emptied wallets one by one, early victims could have raised alarms and saved later ones.nnn

What This Means for Self-Custody

The research findings suggest the event could weaken consumer confidence in hardware wallet safety and self-custody more broadly. With an estimated $102 million taken within hours, that concern is not abstract. The findings also flag possible regulatory scrutiny and louder demands for manufacturer accountability. Ledger has drawn a clear line around its own channels, but customers who lost funds may not find that distinction comforting.nnn

A Practical Checklist

There is a practical checklist for anyone holding a device from a third-party seller. Check the purchase source and date against Ledger's 90-day guidance. Be wary of any device that arrived with packaging or components that seem off.