Ledger Was Hacked — Who Do You Trust With Your Keys Now?

Early on-chain estimates put losses from the Ledger hardware-wallet incident above $90 million across roughly 300 wallets. Devices sold by an authorized Ledger reseller in Southeast Asia reportedly contained a hidden chip that captured what appeared on the screen, including seed phrases, and transmitted it to attackers over cellular. Pablo Sabatella said the implant read the screen without changing the device’s firmware, so Ledger’s firmware-authenticity check could still pass. A user discovered the implant by opening devices to inspect them, and wallet draining began after the implant became public.

The reseller had been an official Ledger seller for years and was acquired months before the incident; its former owners were reportedly barred from disclosing the sale until October. Sabatella said the timing points toward the new owners, but emphasized that their involvement has not been confirmed. He characterized the episode as a supply-chain compromise and warned that sophisticated actors may copy the approach. Ledger’s plastic seal can be faked and offers little assurance against a hardware implant. Suggested inspection measures include transparent casings, tamper-evident packaging, weighing devices, and X-raying them; Sabatella expects future wallets to erase themselves if opened.

His advice depends on where a device came from. He said devices purchased directly from Ledger should be fine and that Amazon usually ships devices from Ledger. A device from the implicated Southeast Asian reseller should be treated as high risk: do not open it, and move funds to another address. For a Nano S, Nano S Plus, or Nano X bought from another reseller, consider opening it only if you know how and have confirmed your backup, since opening the device could break it. More generally, do not rush to move funds or create a replacement wallet during an incident; hurried steps can cause losses.

For larger holdings, Sabatella recommended layered security, such as a 2-of-3 multisig arrangement with each key held on a different hardware-wallet brand. He stressed that no setup is 100% secure. Another option is to split a seed phrase into three overlapping lists so any two can reconstruct the 24 words, then store each list separately in a sealed tamper-evident bag. That approach cannot protect funds if the seed was already captured when displayed on a screen. Buying directly from Ledger avoids reseller-device risk, but not every risk: Ledger’s 2020 customer-data leak exposed buyers’ names and home addresses.

Sabatella advised limiting the personal information attached to purchases by using an identity other than your real one and shipping to a hotel, a friend’s home, or a PO box. He also suggested keeping separate email addresses for company, personal, private-account and recovery, and one-off-purchase use. Physical security matters too: a remote organizer could map a victim’s on-chain holdings and pay robbers to carry out a wrench attack. Sabatella advised not bragging about holdings and creating physical and time-based distance from funds; he does not travel with his hardware wallet. Active DeFi users might use time-locked multisig with an emergency option that sends funds only to a pre-approved address, such as a regulated custodian, though he said users cannot set this up themselves.

Sabatella said self-custody still demands technical ability and is not ready for mass adoption. People with substantial holdings should consider having a security consultant review their setup and practices; those unsure about self-custody and holding more than around $50,000 should consult a security professional. Long-term holders who do not want to manage keys could consider a qualified custodian or Bitcoin ETF. In his view, people who have carefully self-custodied for years, bought directly, and kept their seed only on paper can continue, and the vast majority of Ledger users are fine. He also warned that AI can help identify low-severity vulnerabilities and chain them into critical exploits, while companies may struggle to fix issues quickly. His belief that at least one-third of incidents involve current or former employees is unproven; he said researchers may sell vulnerabilities to exploit brokers or turn malicious when reporting and bounty processes fail them.