Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?

A supply-chain attack on Ledger wallets may have caused more than $100 million in losses, according to John T. Seal’s estimate of inflows to theft addresses. The estimate exceeds the losses reported to Seal 911, which began investigating after receiving reports of drained Ledger wallets, so it is not a confirmed total. On-chain analysis found smaller drains before the major wave on October 9, with the earliest identified activity on September 8.

Ledger said a highly organized criminal group bought genuine devices over several months, installed hidden components, and returned the wallets to circulation through Southeast Asian resellers. Mark Karpeles said the implant captures a wallet’s 24-word recovery phrase during setup and sends it to attackers through mobile connectivity and an eSIM, bypassing the device’s hardware protections. The implants were reportedly customized for different Ledger models; one found in a Ledger Flex bought at Singapore airport used components designed for that device’s connectors. Speakers said the newer design appeared easier to install and suited to mass production than earlier, expensive implants aimed at specific targets, but how the devices entered reseller stock and how widely they spread remained unclear.

Ledger linked the incident to Crypto Billis, an authorized reseller operating across Indonesia, Malaysia, and the Philippines, and asked it to pause sales and shipments during the investigation. The reseller’s founder reportedly sold the company about six months earlier, but Karpeles and other speakers stressed that no culprit had been confirmed and cautioned against accusing anyone without evidence. Reports of compromised devices also emerged in Europe: 0xjojanes said spyware was found in two devices bought from official reseller locations, including separate Media Markt stores. Karpeles said a device sent to him contained an implant, but speakers were unaware of reports connecting European purchases to crypto theft. Ledger said devices examined in Germany and warehouse samples were clean, and that it had found no compromised devices in verified MediaMarkt inventory.

The incident exposed a trade-off in how people buy hardware wallets. Buying directly from the manufacturer reduces supply-chain intermediaries, while authorized resellers can provide privacy, allow in-person cash purchases, or serve people who face barriers to importing devices. Speakers cited Vietnam’s license requirement for importing cryptographic devices. They also called for clearer buyer guidance and tamper-evident packaging. Ledger packaging reportedly said an anti-tampering sticker was unnecessary because software integrity is checked at startup and the secure element prevents interception or physical replacement; speakers questioned whether that reassurance is enough for buyers confronting a compromised supply chain.

Despite the attack, speakers continued to view hardware wallets as a strong self-custody option for retail users because private keys and transaction signing stay off internet-connected computers. They said hot wallets account for significantly more losses, but self-custody is optional: exchanges or ETFs were mentioned as alternatives for people seeking exposure to mainstream coins. Anyone who used a compromised Ledger should treat it as compromised and move assets to a fresh, secure wallet, such as an uncompromised hardware wallet or a temporary software wallet. Speakers warned against panic or careless attempts to open devices or move assets, which could damage a wallet or lead to loss of access; opening a device can also void its warranty and may cause injury.

Tether froze about $10 million in USCT, while another 464 ETH went through Tornado Cash; PeckShield traced less than $4 million to Binance deposit addresses. CL911 said rapid notification helped trace assets and work with Tether and law enforcement to freeze funds, and that a faster industry response could have saved multiples of the $10 million. Recovering frozen assets will be difficult because losses from many people across jurisdictions were commingled and may require lawyers, prosecutors, and international law enforcement. CL911 was cautiously optimistic that some funds could be recovered, but said the process could take months or years; the perpetrators’ identities and relevant jurisdiction remain unknown, and authorities’ ability to act may depend partly on where the tampering occurred.