Ledger Hardware Wallets Targeted by Organized Crime Group

Paris-based hardware wallet maker Ledger said Thursday an organized criminal group spent millions targeting Ledger hardware wallets by buying devices, implanting hardware to read seed phrases, and returning them to resellers before draining customer funds.

The company called it one of the most sophisticated attacks in the digital asset industry. Ledger said the scheme began after customers in Southeast Asia reported losses following purchases from Malaysia-based reseller CryptoBilis. Investigators confirmed one affected device contained an unauthorized implant, though Ledger did not disclose how much was stolen. Blockchain investigator Specter estimated $86 million had been drained.

How the Ledger hardware wallet supply chain attack worked

Ledger said the group built logistics and technology infrastructure, including seed collector servers, draining and laundering systems. It stressed that its chip, operating system and servers were not compromised and that the attack occurred after devices left its control.

Ledger said it sent employees to other markets, including Europe, to check supply chains. It said screened devices were clean and authorized resellers and distributors in Southeast Asia and Hong Kong suspended sales. The company is working with law enforcement to trace funds and dismantle the attackers’ infrastructure. The number of targeted customers was not disclosed.