Ledger has disclosed details of what it describes as one of the most sophisticated attacks targeting the digital asset industry, involving an organized criminal group that tampered with hardware wallets and reintroduced them into the supply chain.
The Paris-based hardware manufacturer said a criminal group purchased Ledger devices and installed unauthorized hardware implants designed to read users' seed phrases before returning the devices to the market via resellers. The attack came to light after customers in Southeast Asia reported fund losses following purchases from Malaysia-based reseller CryptoBilis.
Ledger confirmed that at least one affected user's device contained an unauthorized hardware implant. According to blockchain investigator Specter, approximately $86 million was drained from compromised wallets, though the exact total loss remains unclear.
In a statement, Ledger said the criminal group operated with significant resources and coordination: "[The criminal group] built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets."
Ledger emphasized that the breach did not stem from vulnerabilities in its hardware, operating system, or servers. "There was no flaw in Ledger's chip, operating system or servers. Ledger's systems were not compromised. This was an attack on the distribution channel after the devices left our control," the company stated.
The company conducted what it described as its largest investigation to date, sending employees to markets including Europe to verify that other supply chains had not been compromised. Ledger said screened devices came back clean and that authorized resellers and distributors in Southeast Asia and Hong Kong have suspended sales.
Ledger is working with law enforcement to trace the funds and dismantle the attackers' infrastructure. The number of targeted customers has not been disclosed.
The attack follows a July incident in which hackers stole close to $120 million in bitcoin from Coldcard users. Ledger has also dealt with data breaches this year, with scammers targeting customer information obtained through the company's payment processor Global-e.
