Ledger Confirms Hardware Implant Attack While Denying Breach Of Its Systems
In Brief
Ledger confirmed tampered hardware wallets contained implants amid theft reports, denying its systems were breached and urging users to move funds.
Ledger has confirmed that at least one hardware wallet involved in a recent theft campaign contained an unauthorized implant, providing direct evidence of physical tampering. The company stressed that its internal security infrastructure, systems and services show no signs of compromise, indicating that the attack was introduced through the hardware supply chain rather than Ledger’s software or corporate network.
The device was linked to CryptoBilis, an authorized Ledger reseller operating in Indonesia, Malaysia and the Philippines. Some devices distributed by the company were reportedly modified in a way that allowed attackers to recover users’ seed phrases and transfer funds while the wallets could still pass standard authenticity checks. Ledger has requested that CryptoBilis halt sales and shipments while the investigation continues. The distributor has suspended all hardware wallet inventory sales as a precaution.
Early on-chain analysis placed losses linked to the incident at more than $86 million. A subsequent estimate from cybersecurity outlet Yfarmx raised the figure to approximately $93.4 million across 471 addresses, although Ledger has not verified either total. The potential scale of the thefts has made the incident one of the most significant recent examples of a hardware-level cryptocurrency supply-chain attack.
Ledger said the number of affected devices is limited and that it is contacting impacted users. The company is also cooperating with law enforcement and has enlisted the support of blockchain security group SEAL 911. It encouraged anyone with relevant information to contact its bug bounty program.
Tampering May Have Reached European Retail
The incident may no longer be confined to Asia. A European buyer said he had purchased a Ledger from the consumer electronics chain MediaMarkt approximately two weeks earlier and later discovered a suspicious implant inside the device. Photographs circulated online appeared to show an earlier version of the hardware found in the Asian case.
No funds were reported stolen from the European device. The buyer suggested that it may either have malfunctioned or been intended for activation as part of a broader campaign. Mark Karpeles, the former chief executive of the collapsed exchange Mt. Gox, said an antenna marking indicated that it was designed for Eurasian mobile frequencies. That detail could imply that separate implant variants were produced for regions using different wireless networks. Ledger has not confirmed that the European device belongs to the same operation.
For users who purchased a Ledger from CryptoBilis, the company recommends checking official communications before setting up the device. Customers who initialized a wallet within the supplier’s designated 90-day period should consider moving their assets to a newly created wallet protected by a fresh recovery phrase. Unused devices should not be initialized until their status can be verified.
The incident also creates opportunities for phishing and impersonation scams. Ledger reiterated that its support staff will never request a user’s 24-word recovery phrase. Affected customers should rely exclusively on Ledger’s official website, support portal and verified communication channels while the forensic investigation and law-enforcement response continue.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
