Ledger investigates the theft of $86 million linked to malicious hardware modifications in devices sold by Southeast Asian resellers.

Investors moved assets to hardware wallets to keep private keys offline after the FTX exchange collapsed in 2022. This shift toward self-custody grew rapidly. Ledger experienced a security incident in December 2023. A phishing attack on a former employee allowed the publication of a malicious version of the Ledger Connect Kit. A separate incident involves CryptoBilis, an authorized reseller in Southeast Asia, which represents a supply-chain compromise.

1. Ledger ordered CryptoBilis to stop all sales and shipments of Ledger devices. The company issued this order to block the distribution of hardware that may be compromised. The investigation remains ongoing.

2. Ledger stated that its internal infrastructure, systems, and services remain secure. The company confirmed that no customers have reported compromised products purchased directly from Ledger.

3. Ledger provided clear instructions for affected users who purchased devices from CryptoBilis in the last 90 days. The company advised customers not to set up these devices, or if already set up, to move assets to a new Ledger signer with a new recovery phrase.

4. Ledger advised affected users to file complaints with local law enforcement. These reports facilitate formal investigations into the theft and potential prosecution of those responsible for the unauthorized hardware implants.

1. Ledger confirmed that at least one device sold by CryptoBilis contained an unauthorized hardware implant. The incident highlights a failure in supply chain security. Malicious hardware reached end users through an authorized reseller.

2. On-chain investigator Specter estimated total losses at over $86 million. CoinDesk reported losses between $86 million and $93 million. The exploit affected more than 300 wallets across the Ethereum, TRON, and Bitcoin blockchains.

3. Binance co-founder Changpeng Zhao alleged that attackers acquired the reseller and forced them to sign a non-disclosure agreement. Independent sources have not verified this claim. The exact method of the compromise remains unknown.

4. In July 2026, a firmware vulnerability in Coldcard hardware wallets allowed the theft of between $100 million and $130 million in bitcoin. This theft demonstrates the security risks for users who manage their own digital assets via hardware wallets.