Ledger has released a statement describing an incident involving tampered devices and customer fund losses as one of the digital asset industry’s most “sophisticated attacks,” following reports from affected users.
The hardware manufacturer announced on Thursday that a “highly organized criminal group” purchased Ledger hardware, added implants capable of reading users’ seed phrases, and reintroduced the modified devices into the supply chain through resellers.
Based in Paris, Ledger stated last week that it launched an inquiry after customers located in Southeast Asia reported stolen funds following purchases made through the Malaysia-based reseller CryptoBilis.
The manufacturer subsequently confirmed that an unauthorized hardware implant was discovered inside one of the affected user’s devices.
While Ledger did not reply to written inquiries from Bitcoin Magazine regarding the total financial impact, blockchain investigator Specter reported that $86 million had been stolen.
In its Thursday statement, Ledger explained that the criminals “built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets.”
The company also emphasized that “there was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised. This was an attack on the distribution channel after the devices left our control.”
As part of its “largest investigation to date,” Ledger dispatched staff to other regions, including Europe, to verify that additional supply chains remained unaffected.
Ledger noted that inspected hardware tested clean, and authorized distributors and resellers in Hong Kong and Southeast Asia have temporarily halted sales.
Furthermore, the firm is collaborating with law enforcement to “follow the funds and dismantle the attackers’ infrastructure.”
The total number of targeted customers was not specified in Ledger’s announcement.
This incident follows a major July security breach where hackers made off with nearly $120 million in bitcoin from Coldcard users, leaving the cryptocurrency sector shaken.
Additionally, 2024 has seen multiple data breaches, including scam operations targeting Ledger customer data through the firm’s payment processor, Global-e.
Frequently Asked Questions
What happened to Ledger devices?
An organized criminal group bought Ledger hardware, installed unauthorized seed-phrase implants, and placed them back into the supply chain via resellers.
Were Ledger’s internal systems compromised?
No. Ledger stated that its chips, operating systems, servers, and internal systems were not compromised, as the attack targeted the distribution channel after the devices left company control.
How much money was stolen?
While Ledger did not disclose a specific total, blockchain investigator Specter estimated that $86 million was drained.
What is Ledger doing in response?
Ledger launched a major investigation, sent employees to markets like Europe to screen supply chains, paused sales through Southeast Asian and Hong Kong resellers, and partnered with law enforcement.
