Ledger says a highly organized criminal group bought its hardware wallets, installed implants capable of reading users’ seed phrases, and returned the devices to circulation through resellers. The disclosure follows reports of customers in Southeast Asia losing funds after purchasing devices from Malaysia-based reseller CryptoBilis. According to Bitcoin Magazine, Ledger described the incident as one of the most sophisticated attacks to hit the digital-asset industry.
How the attack worked
Ledger said the attackers purchased devices and modified them before placing them back into the supply chain. The unauthorized hardware implants were designed to capture seed phrases, the strings of words that serve as the main recovery credentials for many cryptocurrency wallets. Anyone who obtains a seed phrase can potentially access the associated wallet, making it highly sensitive information.
The company’s investigation began after customers in Southeast Asia reported losses. Ledger later confirmed that at least one affected device contained an unauthorized implant. The company has not disclosed how many customers were targeted or the total value of funds lost.
Blockchain investigator Specter said approximately $86 million had been drained from affected wallets. Ledger did not respond to Bitcoin Magazine’s written questions about the reported losses.
Ledger points to distribution channel
Ledger said the criminal group had developed its own logistics and technical infrastructure, including servers for collecting seed phrases and systems used to drain and launder funds. The company said the group spent millions of dollars and carried out the operation in a coordinated way.
Ledger also said its chip, operating system and servers were not compromised. Instead, it characterized the incident as an attack on the distribution channel after the devices had left the company’s control. That distinction separates the reported tampering from a direct breach of Ledger’s internal systems.
The Paris-based manufacturer said it launched its largest investigation to date and sent employees to additional markets, including Europe, to check whether other supply chains had been affected. It said devices that had been screened were clean. Authorized resellers and distributors in Southeast Asia and Hong Kong have suspended sales, according to the company.
Ledger added that it was cooperating with law-enforcement agencies to track the funds and dismantle the attackers’ infrastructure.
Broader crypto-security concerns
The incident adds to a difficult year for cryptocurrency security. The source report said hackers stole nearly $120 million in bitcoin from Coldcard users in July. Separate data breaches also involved scammers seeking Ledger customer information through the company’s payment processor, Global-e.
For hardware-wallet users, the case highlights the security risks that can arise before a device reaches its buyer, not only from software or company-network vulnerabilities. Ledger’s statement did not establish the full scale of the incident, and the company has not said how many devices may have been altered.
Market picture
Moneyiar market data at 21:44 on October 15, 2026, showed Bitcoin at $82,204.64, up 0.57% over 24 hours and 0.71% over seven days. Among the other tracked assets, edgeX was $0.3166, down 1.72% in 24 hours and 14.65% over seven days; Aethir was $0.005955, down 0.47% and 6.20%; and Walrus was $0.05160, down 20.81% over 24 hours but up 54.90% over seven days.
