Ledger Hardware Wallet Supply Chain Compromise Results in $93.4M Crypto Drain

In mid‑2025, Ledger Nano X/S devices sold through authorized reseller CryptoBilis were found to contain a covert hardware implant—a soldered SMD chip or modified PCB component—that exfiltrated seed phrases and enabled unauthorized transaction signing when connected to a host. Blockchain forensics traced over $93.4 M in drained assets across hundreds of addresses, linking the thefts to a supply‑chain tampering campaign that extended from Southeast Asia to Europe. Ledger halted CryptoBilis sales, issued user warnings, and launched a forensic audit.

• Incident/Breach Overview:
• Ledger Nano X/S wallets sold via CryptoBilis in mid‑2025 showed unexplained outflows.
• By Oct 2026 Ledger confirmed a hidden hardware implant in a customer device.

• Over $93.4 M drained across hundreds of blockchain addresses.

• Attack Vector/Campaign Mechanics:

• Implant: soldered SMD chip or modified PCB component inserted during manufacturing/reseller handling.
• Firmware anomaly: unauthorized code in secure element triggers on USB connection, leaking seed phrases to C2.
• Power‑analysis and X‑ray scans reveal covert communication and solder‑joint irregularities.

• Transaction pattern: rapid sweep of BTC, ETH, ERC‑20 tokens post‑activation via automated scripts.

• Threat Group Profile/Scale of Impact:

• No identified threat actor; operation likely conducted by a sophisticated supply‑chain adversary with factory‑level access.
• Affected devices: hundreds of distinct wallets, user reports >1,000 potentially compromised.

• Geographic spread: initial SE‑Asia (Thailand, Vietnam, Malaysia) then Europe (Germany, France, Netherlands).

• Indicators of Compromise (IoCs)/Defensive Actions:

• IoCs: unexpected SMD component on PCB, anomalous firmware hash, C2 DNS/IP observed in blockchain‑linked transactions.
• Ledger halted CryptoBilis sales, issued user warnings, launched product recall/inspection.

• Users advised to verify device integrity via Ledger’s authenticity check and to migrate funds to new wallets.

• Conclusion & Recommendations:

• Incident underscores need for end‑to‑end supply‑chain integrity, including component‑level verification and secure‑element attestation.
• Reseller vetting must include immutable shipment logs and tamper‑evident packaging.
• Hardware‑wallet vendors should implement runtime firmware integrity checks and hardware‑based anti‑tamper sensors.