Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users
Bitcoin Magazine Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users Hardware wallet manufacturer Ledger has released a statement following a “sophisticated” supply chain...
Hardware wallet manufacturer Ledger has released a statement following a “sophisticated” supply chain attack.
Ledger has issued a statement following reports from customers of loss of funds and tampered devices, calling it one the most “sophisticated attacks” the digital asset industry has experienced.
The hardware manufacturer said Thursday that a “highly organized criminal group” bought Ledger devices and installed implants that could read users’ seedphrases before then putting them back into the supply chain via resellers.
Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis.
The company then said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant.
It isn’t clear how much money has been lost from the tampered devices but blockchain investigator Specter said $86 million had been drained. Ledger did not respond to Bitcoin Magazine’s written questions.
“[The criminal group] built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets,” Ledger said in a Thursday statement.
“There was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised. This was an attack on the distribution channel after the devices left our control.”
The company said that in its “largest investigation to date” it sent employees to other markets — including Europe — to make sure other supply chains hadn’t been targeted.
It said that screened devices were clean and authorized resellers and distributors in Southeast Asia and Hong Kong have suspended their sales.
Ledger added that it was working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure.”
The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.
There have also been a number of data breaches this year, with scammers targeting Ledger to get customer information via the company’s payment processor Global-e.
Asanat Analysis — Why it matters
Ledger's disclosure of a targeted supply chain attack signals escalating adversarial sophistication against custodial infrastructure. Organized crime groups with capital to execute multi-million dollar campaigns represent a material shift from opportunistic phishing toward coordinated, infrastructure-level threats. This mirrors historical patterns in traditional finance where high-value targets justify sustained investment in compromise operations. The fact that Ledger—the largest hardware wallet vendor by market share—is naming organized crime involvement publicly suggests the incident exceeded typical security incident thresholds and may have broader industry implications.
Supply chain compromises in crypto hardware occupy a unique attack surface: they can theoretically affect entire user cohorts before detection. This incident will likely accelerate industry-wide scrutiny of manufacturing, distribution, and firmware verification practices. It also reinforces the operational security burden on end users; even 'self-custodial' solutions require verification procedures most retail users lack resources to perform. Regulatory bodies may view this as evidence that self-custody carries unquantified systemic risks, potentially reshaping policy discussions around institutional custody requirements and insurance frameworks for digital assets.