Hackers Steal $90 Million in Hardware Exploit Targeting Ledger Wallets

A sophisticated hardware exploit targeting Ledger cryptocurrency wallets has drained over $90 million from users, exposing a critical vulnerability in the cold-storage supply chain. The thefts, which began emptying accounts on October 9, 2026, trace back to devices that were physically tampered with before they reached customers. The breach explicitly shifts the threat landscape from software bugs to physical hardware interception.[1][2][4]

Attackers intercepted genuine Ledger devices and soldered a microscopic circuit board beneath the OLED screen, occupying the space where the display's protective padding normally sits. This rogue component contains a microcontroller, an antenna, and an eSIM card capable of cellular transmission. The operation required significant funding, coordination, and physical access to the inventory before it was shipped to end users.[2][4]

When a user initializes the wallet, the device generates and displays a 24-word recovery phrase. The hidden implant reads this phrase directly off the display hardware and transmits it to the attackers over an LTE cellular connection. With the recovery phrase in hand, the attackers can rebuild the wallet on their own devices and empty the funds at their convenience, without ever touching the victim's hardware again.[1][3]

Bypassing the Secure Element

Because the malicious hardware only monitors the screen and does not interact with the wallet's cryptographic Secure Element, the tampered devices successfully pass Ledger's official authenticity checks during setup. Forensic analysis of a compromised unit purchased in Malaysia revealed that the devices arrived in intact shrink wrap. The modification is virtually undetectable unless the user physically dismantles the casing to inspect the internal circuitry.[1][4]

Ledger has confirmed the attack and isolated the confirmed drains to devices sold by CryptoBilis, an authorized reseller based in Malaysia that served the Southeast Asian market. The Paris-based manufacturer instructed the vendor to halt all shipments. "If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support," the company advised in its official statement.[2][3]

On-chain forensics tracked the stolen assets across at least six blockchain networks, with total losses exceeding $90 million drained from more than 315 individual wallets. The theft was heavily concentrated on the Tron network, which accounted for roughly $70.5 million of the drained funds, while Bitcoin and Ethereum made up the majority of the remainder. Attackers reportedly routed portions of the stolen cryptocurrency through mixing services to obscure the trail.[3][4]

In response to the breach, stablecoin issuer Tether intervened by freezing approximately $10 million in USDT linked to the attackers' addresses. While this action recovered a fraction of the stolen value, the decentralized nature of the other affected networks meant that the vast majority of the $90 million could not be clawed back. The incident highlights the stark finality of hardware wallet compromises once the recovery phrase is exposed.[4]

Retailers Halt Hardware Sales

The fallout has extended beyond Southeast Asia, prompting concerns about the broader retail network. Following unverified reports of similar tampering in Europe, major electronics retailers began pulling Ledger products from their physical stores and online platforms. Ledger stated it is actively reviewing reports of implants in other locations but maintains that all confirmed thefts to date involve the CryptoBilis supply chain.[2]

The scale of the theft has prompted other hardware wallet manufacturers to reassess their distribution networks. Competitors such as Trezor and OneKey have publicly announced reviews of their authorized reseller programs, with OneKey terminating its relationship with CryptoBilis entirely. The incident underscores the inherent risk of relying on third-party distributors to handle sensitive cryptographic hardware.[1][3]

The exploit appears to have been active in the wild months before the mass drains occurred in October. Security researchers reported finding a similar cellular implant in a Ledger Nano X purchased from a Thai marketplace, notifying the company of the vulnerability in March 2026. Reports indicate that Ledger had received warnings about tampered devices as early as December 2025, raising questions from the crypto community about why a public alert was not issued sooner.[1][2]

The panic surrounding the hardware exploit has already spawned secondary attacks targeting anxious investors. Blockchain security firms reported that scammers are sending widespread phishing emails disguised as an emergency Ledger firmware update. The emails claim to offer a patch against the Malaysian spyware threat, directing users to a fraudulent verification portal that prompts them to type in their 24-word recovery phrase.[3]

A Turbulent Year for Cold Storage

The Ledger exploit represents the latest chapter in a turbulent year for cold storage providers. Over the summer, a software flaw in devices manufactured by Coinkite exposed serious vulnerabilities, resulting in the theft of an estimated $130 million worth of Bitcoin. Shortly after, Trezor encountered a data breach through a shipping provider that exposed the personal information of roughly 67,000 customers, further eroding trust in the hardware wallet ecosystem.[2]

The breach forces the cryptocurrency industry to confront the limits of self-custody security. While offline cold storage effectively protects cryptographic keys from remote software hacks, it cannot defend against physical interception during transit. The incident demonstrates that users must trust not only the device's encryption but the physical integrity of the entire supply chain from the factory floor to their front door.[1][4]