The theft linked to physically modified Ledger hardware wallets has reached approximately $90 million, a material increase in the verified scale of the supply-chain attack.
The Financial Times reported that organized criminals bought genuine devices, opened them, installed custom components capable of capturing recovery phrases during setup and returned the products to distribution. The attackers also built collection servers and laundering infrastructure before draining wallets in a coordinated operation.
All affected devices identified in the latest reporting were sold through CryptoBilis, a Malaysian reseller. CryptoBilis paused Ledger sales and shipments. Ledger said its internal systems were not breached and described the attack as occurring after devices left its control.
The implant attacked the trust boundary around the device rather than the wallet’s cryptography. A genuine firmware check could not detect a separate component monitoring information presented during setup.
Ledger has told partners that returned devices cannot be resold, even when packaging appears intact. Rival Trezor is also reducing and rechecking its reseller network, reflecting an industry-wide recognition that hardware provenance is part of wallet security.
TOKEN RECON ASSESSMENT
The confirmed loss turns reseller chain-of-custody from an operational detail into a critical security control. Users who initialized a device obtained through CryptoBilis should follow Ledger’s incident guidance and move assets to keys generated on a verified replacement device. The decisive remaining facts are the number of modified units, the full distribution footprint and whether law enforcement can identify the implant and laundering operators.
Sources: Financial Times, CoinDesk, Trezor.
