started · updated
Ledger hardware wallets targeted in $102 million supply-chain attack
A major hardware supply-chain attack has targeted Ledger cryptocurrency users, resulting in the theft of approximately $102 million from hundreds of wallets across multiple blockchain networks. Forensic investigations reveal that attackers physically tampered with authentic Ledger devices before they reached consumers through the authorized reseller CryptoBilis.
The attackers embedded sophisticated microscopic hardware implants into the devices. These implants were designed to intercept the 24-word recovery seed phrases displayed on the device's OLED screen during the initial setup process. Once the phrases were captured, the rogue components used embedded SIMs and LTE connections to exfiltrate the sensitive data to the criminals, bypassing the device's secure element and the user's internet connection.
The breach has sparked significant debate regarding corporate transparency. Former Mt. Gox CEO Mark Karpelès criticized Ledger, claiming the company could have prevented much of the loss if it had issued stronger public warnings after receiving reports of tampered devices earlier in 2026. Ledger has responded by emphasizing that its core cryptographic security and operating systems were not compromised, but rather the physical hardware was manipulated after leaving their direct control. In response to the incident, the company is developing the Ledger Atom, a new device featuring enhanced tamper-detection technology.
Entities
Chainalysis · CryptoBilis · Joe Grand · Ledger · Mark Karpelès · Pascal Gauthier · Southeast Asia
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 4 SOURCES] The rogue implants used embedded SIMs and LTE connections to exfiltrate stolen recovery phrases. cryptoslate.com · altcoininvestor.com · portaldobitcoin.uol.com.br
- [● 7 SOURCES] Hardware implants intercepted 24-word recovery phrases by reading the device's OLED display during setup. btcwires.com · cryptoslate.com · dev.to · altcoininvestor.com · www.finance-monthly.com · +1 more
- [● 2 SOURCES] A task scam operator lost over 60 Bitcoin, valued at approximately $4.8 million, in the attack. blockcast.it · portaldobitcoin.uol.com.br
- [● 6 SOURCES] The tampered devices were distributed through the authorized reseller CryptoBilis. www.finance-monthly.com · cryptobriefing.com · cryptoslate.com · altcoininvestor.com · btcwires.com
- [● 5 SOURCES] Ledger confirmed that authentic devices were physically tampered with before reaching customers. www.finance-monthly.com · cryptobriefing.com · cryptoslate.com · world-today-journal.com
- [● 4 SOURCES] On-chain data indicates approximately $102 million was withdrawn from 335 wallets across six networks. cryptoslate.com · www.lavocedivenezia.it · altcoininvestor.com · www.tokenpost.com