Supply-Chain Attack Hits Ledger Wallets Sold by Reseller, Draining Over $90 Million
A major supply-chain security breach compromised cryptocurrency hardware wallets made by Ledger and sold through Southeast Asian distributor CryptoBilis. Perpetrators installed unauthorized internal hardware implants that recorded users' 24-word recovery seed phrases during setup and transmitted them via cellular networks. On October 9, 2026, the attackers executed a rapid, coordinated strike across more than 300 wallets, stealing between $93 million and $102 million worth of digital assets, including Bitcoin, Ethereum, TRON, and stablecoins.
The coordinated theft highlights critical vulnerabilities in third-party retail distribution networks for hardware storage solutions. Individual losses were substantial, including single balances of up to 80 Bitcoin worth $4.8 million. Stablecoin issuer Tether successfully froze roughly $10 million in USDT connected to the malicious addresses. While Ledger stated that its direct sales channels and core systems remained secure, the incident underscores the broader risks facing investors relying on hardware wallets for private seed phrase protection.
Ledger is issuing safety updates specifically directed at customers who purchased devices from CryptoBilis within the trailing 90 days. Users are urged to carefully verify the physical integrity and origin of their hardware storage before initial configuration, as generating a new recovery key on an infected device will still expose funds to the intruders. Market participants will also monitor potential regulatory responses and heightened accountability requirements for third-party cryptocurrency device sellers.
Key points
- Attackers used cellular-enabled hardware implants in Ledger devices sold by reseller CryptoBilis to capture recovery seed phrases.
- The synchronized strike on October 9, 2026, drained more than 300 wallets, taking an estimated $93 million to $102 million in crypto assets.
- Ledger confirmed its own internal systems and direct sales channels were unaffected, while reseller CryptoBilis paused sales.
- Tether froze approximately $10 million in USDT linked to the wallet addresses used by the perpetrators.
- Affected users are advised to check purchases made through CryptoBilis in the past 90 days before setting up or transferring assets.
Written by our AI from expert market sources across the web. It can contain mistakes: check the facts before acting on them. Write-ups powered by the free AI API at FreeTheAI.org
How we writeDisclaimerQuestions and answers
How were the Ledger devices compromised in the supply-chain attack?
Unauthorized hardware implants were added to devices sold by a reseller to record seed phrases and send them over cellular networks.
How much money was stolen in the Ledger supply-chain attack?
Total estimated losses ranged between $93 million and $102 million across more than 300 compromised wallets.
Are devices purchased directly from Ledger safe?
Yes, Ledger confirmed that its direct sales channels and internal systems remained secure during the breach.