Ledger, a hardware crypto wallet manufacturer, confirmed that at least one affected user device contained illegally implanted hardware components. As of 11/10, all confirmed cases were linked to devices sold through CryptoBilis, a leading crypto wallet distributor in Southeast Asia. Ledger's internal systems and direct sales channels showed no signs of compromise.

Unlike typical phishing scams that require users to manually enter security information into fake websites or applications, this incident appears to originate from compromised hardware. Security researchers, as cited by BleepingComputer, suggest that implanted components within the devices could record screen content and user button presses. This data would enable attackers to collect the wallet's recovery phrase (seed phrase), a sequence of typically 12 or 24 words essential for restoring asset access if a device is lost.

Researchers further indicated that these malicious components might transmit collected information externally via a mobile connection, utilizing an eSIM. Once the recovery phrase is obtained, attackers could restore the wallet on another device and transfer funds to their controlled addresses.

This described mechanism, however, is a deduction by researchers based on device examination and not Ledger's full conclusion regarding how or when the hardware was compromised. The company has not yet disclosed the number of modified devices, the perpetrators behind the incident, or whether all drained wallets were attacked identically.

Several models of crypto wallets manufactured by Ledger. Photo: Ledger

Initial estimates of the stolen funds vary. Bitquery reported approximately 93,2 million USD in crypto taken from 315 wallets across 6 blockchains, primarily USDT and TRON tokens. Separately, security research platform YFarmX indicated 94,5 million USD from 521 addresses across 7 blockchains. These figures are based on public data and do not represent Ledger's confirmed total losses.

Tether, the issuer of stablecoin USDT, has frozen 10 million USD connected to the incident. Bitquery noted that about 81 million USD remained traceable on the blockchain as of 11/10, despite some assets having moved through privacy services like Tornado Cash and Zcash.

Ledger designs cold wallets to store private keys offline and requires users to confirm transactions directly on the device. However, if the hardware is compromised before reaching the buyer, attackers could potentially gather critical security information, such as the seed phrase, thereby seizing control of the wallet's assets.

CryptoBilis, a major retailer in the cryptocurrency sector, was established in 2020 in Malaysia. The company specializes in distributing hardware wallets for digital assets and related products. It sells devices from various brands, including Ledger, Trezor, and Tangem, and is known for organizing cryptocurrency events and community activities in Southeast Asia, particularly in Malaysia, the Philippines, and Indonesia.

In response, CryptoBilis has temporarily halted sales and shipments of hardware wallets during the ongoing investigation. Ledger advises customers who purchased devices from this distributor within the last 90 days not to use them if they have not yet been set up. For those who have already set up their wallets, the recommendation is to transfer assets to a new device with a completely new recovery phrase.

This incident has raised significant concerns about the supply chain security of crypto devices. Even if a device is distributed through an authorized sales channel, risks can emerge if it is tampered with before reaching the customer. Ledger has not yet confirmed any compensation plans for those who incurred losses.