In October 2026, some Ledger users were the target of a supply chain attack, where on-chain analysis estimates $93 million was stolen from accounts protected by a Ledger hardware wallet. Hardware distributed by one of the company’s resellers included components that stole recovery phrases for accounts stored on the device.
Inside the Attack
The Ledger supply chain incident was discovered on October 9, when users of the hardware wallet started reporting that funds were disappearing from their on-chain accounts. Ledger confirmed an unauthorized implant in at least one device sold by CryptoBilis, a Ledger reseller located in Southeast Asia, and its security team has since described how the implant worked.
This implant monitored the hardware wallet’s screen during setup and captured the 24-word recovery phrase that can be used to regenerate the root key for the account so the user could transfer it to another device if desired. The implant included an eSIM that allowed it to transmit the stolen recovery phrase to the attacker via LTE.
The malicious implant didn’t interact with the device’s Secure Element or any of the transaction or signing logic. However, stealing the root key undermined the security of the associated accounts since the attacker could derive any private key generated and stored on the device and steal the associated crypto.
After the attack was identified, Tether froze about $10 million in USDT. Ledger also issued guidance to users not to initialize unused CryptoBilis devices and to migrate any crypto on a CryptoBilis hardware wallet to a new device with a fresh recovery phrase. Ledger asked resellers in seven Asian markets to suspend sales and remove devices from shelves.
Devices sold by CryptoBilis are the only ones Ledger has tied to confirmed losses so far, but other reports suggest the tampering may reach beyond that reseller. On October 13, former Mt. Gox CEO Mark Karpelès publicly confirmed that a Ledger Flex purchased at Singapore’s Changi Airport from retailer Metapod had been implanted with a spy module, though Ledger has not publicly confirmed a connection to the CryptoBilis cases.
A researcher also reported similar modifications in wallets bought at MediaMarkt stores in Europe, and store records he shared list a European distributor as the inventory source, but those records do not show the distributor supplied the specific wallets or took part in modifying them, and no link has been proven.
Lessons Learned from the Attack
The Ledger supply chain incident demonstrates how physical implants can bypass protections on hardware wallets. While the core Ledger circuitry and logic were unaffected, the attacker took advantage of the fact that the screen needed to display sensitive information (the recovery phrase) to the user. An implant that could also monitor the screen could steal and exfiltrate the recovery phrase, resulting in an estimated $93 million in losses.
This incident demonstrates the risks associated with extended supply chains for hardware wallets and similar devices. The compromised devices came from an authorized reseller. Buying directly from the manufacturer helps to reduce risk by limiting the number of parties with physical access to a security-critical device.