Ledger Wallets Tampered With Before Sale: How a Supply-Chain Attack Drained Up to $100 Million
Hardware wallets are supposed to be the place where your crypto goes to hide from hackers.
Offline keys. Secure chips. Physical confirmation.
Very reassuring.
Until someone modifies the hardware wallet before you even buy it.
That is the uncomfortable lesson emerging from a major October 2026 security incident involving Ledger devices sold through a reseller in Southeast Asia.
Investigators have traced tens of millions of dollars in stolen digital assets to wallets associated with tampered devices. Depending on the on-chain analysis used, estimates range from roughly $90 million to more than $100 million.
Ledger has not publicly confirmed a final loss figure, but it has confirmed that at least one affected device contained an unauthorized physical implant designed to capture a user’s recovery phrase during setup.
That is a rather creative way to redefine the phrase “cold storage.”
First, the Important Clarification: Ledger’s Core Systems Were Not Hacked
The story quickly generated headlines suggesting that Ledger hardware wallets themselves had been “broken.”
That is not quite what happened.
Ledger says its secure chip, operating system, internal servers and direct sales channels were not compromised.
Instead, criminals targeted the distribution chain after genuine devices had left Ledger’s control.
According to Ledger’s own incident response, attackers acquired legitimate devices, opened them, inserted custom hidden hardware and then placed the modified devices back into circulation through resellers.
So the attackers did not defeat Ledger’s encryption.
They simply arrived earlier.
Much earlier.
The Attackers Bought Real Wallets
This is what makes the attack particularly dangerous.
The devices were not cheap counterfeits with a Ledger logo printed in someone’s garage.
They were genuine products.
The secure element was real.
The firmware could still pass authenticity checks.
From the customer’s perspective, everything could appear perfectly normal.
Independent reporting links the affected devices primarily to CryptoBilis, a reseller operating in Southeast Asia and previously listed as an authorized Ledger reseller for markets including Malaysia, Indonesia and the Philippines.
That detail matters.
For years, hardware-wallet users have been told:
“Do not buy from random sellers.”
Reasonable advice.
In this case, some buyers appear to have purchased through a recognized reseller.
Which makes “just buy from an authorized seller” slightly less comforting than it used to be.
The Hidden Implant Was the Real Weapon
According to Ledger, the attackers installed custom hidden components inside selected devices.
The purpose was not to crack the wallet’s secure element.
It was to capture the recovery phrase generated during setup.
That recovery phrase — usually 24 words — is effectively the master key to the wallet.
Anyone who obtains it can recreate the wallet elsewhere.
No physical Ledger device is required.
No PIN is required.
No dramatic Hollywood hacking sequence is required.
Just the words.
Once attackers had the recovery phrase, they could recreate the victim’s wallet on another device or compatible software and transfer the assets themselves.
The hardware wallet could remain peacefully sitting in the owner’s safe while the money disappeared somewhere else.
Efficient, if ethically suboptimal.
How Could the Implant Read the Recovery Phrase?
Researchers and media reports indicate that modified components were positioned inside the device near the display circuitry.
The implant could reportedly observe or capture information displayed during the initial setup process.
Some reports describe custom cellular components using eSIM or LTE connectivity to transmit captured data remotely.
Ledger itself has confirmed the presence of an unauthorized implant and says the components were designed to capture the recovery phrase.
However, the company has been more cautious about publicly confirming every technical detail reported by outside investigators.
That distinction is worth keeping in mind because the investigation is still evolving.
The Criminals Were Patient
This was not a smash-and-grab attack.
Ledger describes the operation as highly organized and says the group worked over a period of months.
Attackers reportedly:
- purchased genuine devices;
- physically modified them;
- created custom hardware;
- returned the devices to distribution;
- built infrastructure to collect stolen recovery phrases;
- waited for victims to deposit assets;
- and later drained wallets in a coordinated operation.
That level of patience is important.
A victim could initialize a wallet and use it normally for weeks or months.
Nothing unusual had to happen immediately.
The attacker already had the key.
They could simply wait until the wallet became financially interesting.
Cybercrime, apparently, has discovered long-term investment strategy.
How Much Was Stolen?
This is where the numbers become slightly messy.
Different blockchain-analysis groups have reached different totals.
CoinDesk reported estimates of approximately $93.2 million to $94.5 million based on public blockchain data.
Bitquery later updated its own tracing analysis to approximately $102 million, spread across hundreds of wallets and multiple blockchain networks.
Financial Times reporting described the theft as approximately $90 million.
Ledger itself has not confirmed an exact total.
So the safest conclusion is:
independent investigators currently estimate losses in the range of roughly $90 million to $102 million.
Not exactly the sort of rounding error most wallet owners enjoy.
Hundreds of Wallets May Have Been Affected
On-chain researchers have linked the theft to hundreds of wallet addresses.
Different investigations produced different counts because analysts used different clustering methods and updated their estimates as money moved.
One CoinDesk report cited between 315 and 521 addresses, depending on the analytics provider.
Bitquery later reported more than 300 wallets in its analysis.
The exact number of physically modified devices remains unknown.
That is another important distinction.
A blockchain address associated with stolen funds does not necessarily equal one compromised physical wallet.
The Money Moved Across Several Blockchains
The stolen assets were not confined to Bitcoin.
Investigators traced activity involving several networks and asset types.
Reports have identified transfers involving:
- Bitcoin;
- Ethereum;
- USDT;
- USDC;
- TRON-based assets;
- and other tokens.
This made the laundering process more complicated to follow, but blockchain transparency also allowed investigators to trace large portions of the stolen funds.
That is the awkward irony of crypto crime.
The money can move very quickly.
But the public ledger has an excellent memory.
Tether Froze Around $10 Million
One advantage of centralized stablecoins is that issuers can sometimes freeze tokens linked to criminal activity.
Tether reportedly froze approximately $10 million in USDT connected to the attack.
That does not mean victims automatically receive the money back.
A freeze simply prevents those particular tokens from moving.
Recovery still requires legal, investigative and operational processes.
Other assets such as Bitcoin cannot simply be frozen by an issuer.
Once they move, investigators must trace them and attempt to identify points where the funds interact with centralized services.
Some Funds Went Through Privacy Tools
Investigators reported that part of the stolen money was moved through services designed to make tracing more difficult.
These reportedly included Tornado Cash and privacy-focused cryptocurrency infrastructure.
This is a common pattern in major crypto thefts.
Attackers rarely leave $90 million sitting politely in one address with a note saying:
“Please confiscate.”
Funds are divided, swapped, bridged and moved across chains.
The objective is to break the transaction trail before eventually converting the assets into something usable.
Why Ledger’s Genuine Check Did Not Necessarily Catch It
Ledger devices include authenticity mechanisms designed to verify whether the secure element and firmware are genuine.
But this attack created a different problem.
If the legitimate Ledger hardware remains intact and an attacker adds another component around it, the original security chip may still behave exactly as expected.
The wallet is genuine.
It simply has an unwanted roommate.
Ledger has acknowledged that authentication mechanisms designed to confirm genuine hardware are not necessarily intended to identify every possible additional physical implant.
That exposes a difficult challenge for hardware security generally.
Software can verify software.
A chip can authenticate another chip.
But detecting a cleverly added physical component can require entirely different anti-tamper protections.
Ledger Calls It a Distribution-Channel Attack
Ledger has pushed back against descriptions of the incident as a systemic compromise of its manufacturing process.
The company describes the event as a localized attack on the distribution channel after products left its control.
That distinction is important for understanding the technical risk.
There is currently no evidence that every Ledger device — or devices purchased directly from Ledger — was compromised.
Ledger says its direct sales channels remain unaffected.
Still, the incident raises an uncomfortable question:
If an authorized reseller can become part of the attack surface, where exactly does hardware security begin and end?
CryptoBilis Sales Were Halted
Ledger instructed CryptoBilis to stop sales and shipments while the incident was investigated.
The company also warned customers who recently purchased devices through the reseller not to initialize them.
Users who had already initialized such devices were advised to move their funds to a different wallet using an entirely new recovery phrase.
That last part is crucial.
Moving funds to another device while reusing the same compromised seed phrase would accomplish approximately nothing.
The attacker already has the seed.
A new device needs a new secret.
This Is Different From Ledger’s 2023 Connect Kit Attack
Ledger has faced security incidents before, but the October 2026 event is technically very different.
In December 2023, attackers compromised Ledger’s Connect Kit software library after phishing a former employee.
Malicious code was then loaded by third-party applications and tricked users into approving transactions that drained their wallets.
Ledger later said approximately $600,000 in assets were affected by that incident.
The hardware itself was not compromised.
The 2026 incident is more disturbing precisely because the physical device became part of the attack.
And Then There Was the 2020 Data Leak
Ledger also suffered a major customer-data breach in 2020.
Attackers accessed an e-commerce and marketing database.
More than one million email addresses were exposed, along with approximately 272,000 customer records containing information such as names, phone numbers and postal addresses.
That breach did not directly expose private keys or funds.
But it gave scammers valuable information for phishing campaigns.
In other words:
2020 — criminals learned who owned Ledger devices.
2023 — criminals compromised software used around Ledger devices.
2026 — criminals apparently decided to put extra hardware inside some of them.
Cybersecurity evolution is fascinating when you are not the victim.
What Did Ledger Change After the Attack?
Ledger says it is reviewing reseller controls, anti-tampering measures and distribution security.
The incident is likely to increase pressure on hardware-wallet manufacturers to improve physical integrity checks throughout the supply chain.
Future defenses may include stronger tamper-evident packaging, physical inspection systems and tighter control over returned or resold devices.
Ledger’s newer products are also reportedly incorporating more extensive anti-tamper protections.
The Biggest Lesson: Your Wallet Is Only as Secure as Its Journey to You
Hardware wallets remain one of the strongest ways to protect digital assets when used correctly.
But the Ledger incident demonstrates something security professionals have known for a long time:
hardware security does not begin when you turn the device on.
It begins at manufacturing.
Then packaging.
Then warehousing.
Then shipping.
Then retail distribution.
Then finally the user.
If an attacker controls one of those stages, even an excellent secure element may not be enough.
Should Ledger Users Panic?
For users who bought directly from Ledger and whose devices show no signs of tampering, the company says its systems and direct channels remain unaffected.
For anyone who purchased through CryptoBilis during the affected period, the situation is more serious.
Ledger recommends not initializing unused devices and moving assets from already-used devices to a newly generated wallet.
Users should also avoid entering a recovery phrase anywhere except on a trusted hardware device during legitimate recovery procedures.
The Uncomfortable Conclusion
The Ledger attack is not a story about hackers magically defeating modern cryptography.
In some ways, it is simpler than that.
They compromised trust.
Users trusted the product.
They trusted the packaging.
They trusted the reseller.
They trusted that the hardware inside the box was the same hardware that left the factory.
The attackers found a gap between those assumptions.
And according to current estimates, that gap may have been worth around $100 million.
The good news is that Ledger’s secure cryptographic architecture appears not to have been fundamentally broken.
The bad news is that criminals discovered they did not necessarily need to break it.
Sometimes the easiest way around the strongest digital lock is simply to modify the door before the customer gets the keys.
