Hardware wallet manufacturer Ledger is facing a security controversy as suspected losses tied to its products climb to $93.4 million. Ledger has not yet provided an official account or confirmed the loss totals, leaving independent investigators and blockchain intelligence firms to analyze the situation.
According to an onchain analysis by Yfarmx reporter John Kamal, suspected losses may have reached $93.4 million across 471 distinct addresses. Blockchain data infrastructure company Bitquery also investigated the matter, putting the figure at approximately $92.9 million across 311 unique addresses, noting that one entity appeared to control all the keys.
Blockchain intelligence firm Chainalysis stated on social media that it is investigating reports of funds stolen from holders of Ledger products and has identified a sophisticated cross-chain laundering operation. Earlier reports indicated that Ledger was investigating losses from users in Southeast Asia who purchased products from a reseller named CryptoBillis. Kamal's analysis noted that CryptoBillis also sold Trezor, Safepal, Tangem, and Onekey hardware wallets, following recent data breaches involving Trezor and Safepal that exposed customer order information.
Investigations into the method of the alleged thefts have brought hardware security into focus. Former Mt Gox CEO Mark Karpelès documented Ledger devices containing hidden surveillance hardware capable of capturing recovery phrases during setup, suggesting that wallets purchased from third-party vendors could be compromised before unboxing. However, neither Ledger nor independent investigators have established a definitive connection between these hardware implants and the reported losses.
Kamal's report indicates that recorded transfers appeared to be authorized using victims' own signing credentials, while certain Bitcoin addresses were drained entirely without returning change UTXOs to original wallets. The activity spanned at least seven blockchains, including Tron, Bitcoin, Ethereum, BNB Chain, Polygon, Base, and Arbitrum, alongside applications such as Thorchain and Tornado Cash.
Current consensus among investigators points toward a potential supply chain attack affecting a subset of machines rather than a remote zero-day exploit. The crypto community awaits a formal postmortem from Ledger to clarify the circumstances behind the incident.
