Ledger hardware wallet supply chain attack: $86 million stolen!
Ledger has just issued a warning: It is investigating a theft involving assets belonging to users in Southeast Asia. The devices involved were purchased from resellers.
Official advice: If you bought a Ledger hardware wallet in the past 90 days, don’t rush to use it.
How much was stolen?
On-chain investigator Specter estimates that the stolen funds came from Bitcoin $BTC , Ethereum $ETH , and hundreds of wallets on the TRON network, totaling more than $86 million. Security researcher tanuki42 previously estimated the losses at over $72 million, and the figure is still rising.
Why can hardware wallets be compromised too?
This isn’t a software vulnerability—it’s a physical supply chain attack.
A hardware security expert demonstrated a tampered hardware wallet with a tiny spy chip implanted inside. It was connected to the SPI bus between the secure element and the OLED screen.
How it works: The chip passively intercepts the recovery phrase displayed on your screen and “reads” it using pattern recognition. It then sends the phrase directly to the attacker through a built-in 4G module and eSIM. The entire process bypasses your computer and triggers no software alerts.
Hardware wallet security has never been just a matter of software. At any point along the way from the factory to your hands, someone could tamper with the device.
Ledger has just issued a warning: It is investigating a theft involving assets belonging to users in Southeast Asia. The devices involved were purchased from resellers.
Official advice: If you bought a Ledger hardware wallet in the past 90 days, don’t rush to use it.
How much was stolen?
On-chain investigator Specter estimates that the stolen funds came from Bitcoin $BTC , Ethereum $ETH , and hundreds of wallets on the TRON network, totaling more than $86 million. Security researcher tanuki42 previously estimated the losses at over $72 million, and the figure is still rising.
Why can hardware wallets be compromised too?
This isn’t a software vulnerability—it’s a physical supply chain attack.
A hardware security expert demonstrated a tampered hardware wallet with a tiny spy chip implanted inside. It was connected to the SPI bus between the secure element and the OLED screen.
How it works: The chip passively intercepts the recovery phrase displayed on your screen and “reads” it using pattern recognition. It then sends the phrase directly to the attacker through a built-in 4G module and eSIM. The entire process bypasses your computer and triggers no software alerts.
Hardware wallet security has never been just a matter of software. At any point along the way from the factory to your hands, someone could tamper with the device.