Ledger, a Paris-based manufacturer of hardware wallets, has traced a series of wallet-draining attacks exceeding $93 million to devices sold through Southeast Asian reseller CryptoBilis. The company confirmed that while some wallets had been compromised, units purchased directly from Ledger’s official sales channels remain unaffected.
Supply Chain Breach Identified
An unauthorized physical implant was discovered in at least one affected device, according to Ledger’s ongoing investigation with law enforcement and cybersecurity firm SEAL 911. The implant, which may have facilitated the theft of cryptocurrency, marks a rare instance of a targeted supply chain attack. The specific technique used to extract funds remains under review.
Ledger urged CryptoBilis, its authorized reseller operating in Southeast Asia, to halt all sales and shipments of its hardware wallets after the breach was identified. The company stressed that the security incident was geographically and commercially isolated, not the result of a widespread system flaw or internal compromise.
Law enforcement and forensic investigators are working closely with Ledger to pinpoint the full scope of the affected units, but current findings center exclusively on hardware acquired via CryptoBilis.
Initial suspicions had centered on a systemic breach, but Ledger has reassured users that its internal systems and core cryptographic infrastructure remain secure. Customers who purchased directly from the company were not impacted by the attack.
On-chain investigator Specter traced stolen assets totaling more than $86 million across hundreds of wallets spanning Bitcoin, Ethereum, and TRON networks. Further analysis by Bitquery, a blockchain analytics provider, found that at least $93.2 million was drained from 315 victims over six networks: Bitcoin, Ethereum, TRON, Solana, BNB Chain, and Polygon.
Blockchain security firm PeckShield reported that nearly $3.9 million of stolen crypto from compromised Ledger wallets was deposited into Binance accounts on the Tron network in the two days prior to October 11.
Mini dictionary: CryptoBilis, an authorized distributor of Ledger hardware wallets in Southeast Asia, became the focal point of this security breach. Supply chain attacks in crypto refer to incidents where devices are tampered with before reaching end users, often by malicious actors within distribution networks.
| Investigator / Source | Estimated Loss | Number of Wallets | Networks Affected |
|---|---|---|---|
| Specter | $86 million+ | Hundreds | Bitcoin, Ethereum, TRON |
| Bitquery | $93.2 million | 315 | Bitcoin, Ethereum, TRON, Solana, BNB Chain, Polygon |
| PeckShield | $3.9 million (deposited to Binance) | — | Tron network |
Official Recommendations for Users
For those who have purchased Ledger hardware wallets from CryptoBilis in the past 90 days or suspect possible tampering, Ledger has outlined urgent steps. Unused devices should not be set up and must remain sealed. For customers who have activated their wallets, transferring crypto assets to a new wallet generated on a guaranteed genuine, untampered device is strongly recommended.
Ledger also cautioned users to communicate only with official support channels and reminded customers that company staff will never seek their 24-word recovery phrase, either by message or phone.
Security experts warn that bad actors often take advantage of such high-profile incidents to launch phishing campaigns, mimicking customer support teams to access users’ sensitive information. Users are urged to remain alert and skeptical of unsolicited communications.
Any communication requesting sensitive recovery information should be treated as a phishing attempt, and only official Ledger support channels should be trusted.
Ledger’s Position in the Crypto Industry
Founded in 2014 and headquartered in Paris, Ledger is recognized as a leading producer of hardware wallets, having sold over 7 million devices worldwide. These wallets store the private keys required to access cryptocurrencies safely offline, shielding users from most online threats.
The current incident underscores risks associated with third-party resellers and the importance of supply chain security in the digital asset industry. While Ledger’s direct customers remain unaffected, investigations continue as authorities and security professionals work to recover lost assets and identify responsible parties.
