Over $86 million in cryptocurrency has been stolen from hundreds of hardware wallets after attackers physically tampered with Ledger devices to secretly intercept passphrases during setup. The sophisticated heist came to light following mounting complaints from users who discovered their accounts had been drained, prompting an investigation into modified devices sold through a third-party retailer.
Photos and video recordings shared on X and Threads appear to show a tiny circuit board sandwiched underneath the wallet's screen. The hidden implant allegedly captures everything displayed on the screen, including the confidential seed passphrase generated when an owner sets up the device for the first time. Using an embedded SIM card, the rogue chip then transmits this sensitive data back to the attackers, allowing them to siphon funds from the compromised accounts.
Ledger confirmed that at least one affected device contained an "unauthorized hardware implant." However, there is no evidence that the company's internal systems were breached or that wallets ordered directly from Ledger were compromised. Instead, the incident appears to be a supply chain attack primarily impacting customers in Southeast Asia who purchased their devices from the reseller CryptoBillis. Ledger has requested that CryptoBillis pause all sales during the inquiry and has published guidance to help owners determine if their hardware has been altered.