Ledger Investigates Hardware Tampering Attack After Over $90 Million in Crypto Stolen

Cryptocurrency hardware wallet manufacturer Ledger is investigating a sophisticated physical tampering attack on its devices after customers reported unexplained losses. Blockchain researchers estimate the total value of stolen digital assets has surpassed $90 million.

The Attack Vector

The investigation is reportedly centered on devices sold through CryptoBilis, a Malaysian cryptocurrency retailer, where customers began reporting missing funds on October 9. According to Paris-based Ledger, an organized criminal group physically installed hidden surveillance components inside a number of its wallet devices before they were sold.

Independent security researchers have determined that the compromised wallets contain added hardware, including cellular chips and SIM cards. These components were designed to intercept sensitive information being sent to the device's screen and transmit it to the attackers via a cellular network. This method allows criminals to access user assets without needing to breach the wallet's primary security chip.

Ad

Broadening Scope and Market Implications

Ledger has indicated the attack's scope may extend beyond the Malaysian retailer, as the company is also examining suspicious devices purchased through other channels. In one reported instance, a Ledger device bought at Singapore's Changi Airport was found to have a tampered display connector and a hidden cellular chip.

The incident highlights significant vulnerabilities in the hardware wallet supply chain, particularly when devices are distributed through third-party resellers or refurbished channels. It raises critical questions about how compromised units entered the retail stream and how many users may still be at risk. Ledger has not yet determined the full extent of the attack or the total number of affected devices and is reportedly cooperating with local law enforcement. CryptoBilis has temporarily closed its physical store in Kuala Lumpur.