Ledger, a leading manufacturer of cryptocurrency hardware wallets, is facing a major security incident as reports reveal its supply chain hack has spread from Southeast Asia to European retailers. Crypto analyst Fto (known as @ftosol) alerted the community, warning XRP holders and other crypto users that devices with embedded LTE-enabled spy chips, originally discovered in Malaysia, have surfaced on store shelves in Europe.
The original attack
The breach originated with CryptoBilis, a Ledger-authorized reseller operating in Malaysia, Indonesia, and the Philippines. Hackers physically tampered with Ledger Nano X hardware wallets before delivery, installing a concealed secondary circuit board beneath the device’s screen. This implant contained an LTE modem and an embedded SIM card.
Once users set up their new hardware wallet, their 24-word recovery phrases appeared on the display. The malicious hardware covertly captured these sensitive words and transmitted them wirelessly via mobile data to attackers. As the private seed phrases were compromised, criminals could access affected wallets remotely from anywhere in the world. Ledger’s own authenticity verification was unable to detect the intrusion since the secure cryptographic chip of the device remained intact and functional.
Blockchain analytics company Bitquery conducted an investigation across multiple chains, including TRON, Bitcoin, Ethereum, BNB Chain, Polygon, and Solana. Their research confirmed more than $100 million in losses, with funds stolen from over 320 wallets.
Mini dictionary: Bitquery, a blockchain analytics firm, specializes in providing tools and services for monitoring on-chain data, tracking transactions, and analyzing blockchain-based activities across multiple networks.
| Network | Losses Detected |
|---|---|
| TRON, Bitcoin, Ethereum, BNB Chain, Polygon, Solana | $100 million+ (combined) |
The supply chain is compromised
New evidence indicates the attack on Ledger’s supply chain is much broader than initially reported. Fto posted images exposing devices with unauthorized circuit boards, confirming that the threat is no longer limited to Asia. Devices containing malicious components are now crossing international borders and being offered to unsuspecting consumers in Europe.
Ledger will never recover from this. The entire supply chain is under attack. It’s no longer isolated. It’s everywhere. Reports tied it back to Asia, but the same malware is now being identified in European retail channels. If compromised devices are already crossing borders, this situation demands immediate action.
The community reacts
Members of the crypto community expressed deep concern about the situation. One observer emphasized that the most alarming aspect is the device’s ability to pass Ledger’s official Genuine Check, as only physical inspection can reveal the implanted board. Another user suggested that Ledger’s significant marketing presence may reduce the public visibility of the incident, potentially minimizing news coverage despite the scale of the breach.
The scariest part of this hack is that Ledger’s own verification cannot detect it. Only opening the hardware reveals the compromised component.
What holders should do
Fto strongly advised users to act without delay and move their assets off affected Ledger devices. Hardware wallets have been widely trusted for secure digital asset storage, but ongoing reports of compromised units have led many investors to reassess their reliance on such devices. Fto concluded that Ledger’s reputation may be permanently damaged by the scale and reach of the current attack.
