A hardware wallet can be offline. But its supply chain isn’t.
Ledger is investigating reports that customers had their crypto assets stolen after buying devices through the CryptoBilis reseller in Southeast Asia. One on-chain analyst estimated losses at approximately $86.9 million across 98 addresses. Another study counted $92.9 million across 311 wallets. The final figures have yet to be confirmed.
One theory is that devices were tampered with before being sold, including modifications to the circuit board that could have exposed the seed phrase. But this has not yet been established as the cause. Ledger itself asked CryptoBilis to stop sales and warned customers who had bought devices there in the past 90 days.
CZ also drew attention to the risk of a supply chain attack.
Here’s what often gets lost in the phrase “cold wallet”: protecting your keys won’t help if someone got your seed phrase before you even started using the device. At the same time, this incident does not prove that all Ledger devices are unsafe.
My simple security habit: check not only the technology, but also the path it took to get to me. In crypto, sometimes the weakest link isn’t the code—it’s the box.
Ledger is investigating reports that customers had their crypto assets stolen after buying devices through the CryptoBilis reseller in Southeast Asia. One on-chain analyst estimated losses at approximately $86.9 million across 98 addresses. Another study counted $92.9 million across 311 wallets. The final figures have yet to be confirmed.
One theory is that devices were tampered with before being sold, including modifications to the circuit board that could have exposed the seed phrase. But this has not yet been established as the cause. Ledger itself asked CryptoBilis to stop sales and warned customers who had bought devices there in the past 90 days.
CZ also drew attention to the risk of a supply chain attack.
Here’s what often gets lost in the phrase “cold wallet”: protecting your keys won’t help if someone got your seed phrase before you even started using the device. At the same time, this incident does not prove that all Ledger devices are unsafe.
My simple security habit: check not only the technology, but also the path it took to get to me. In crypto, sometimes the weakest link isn’t the code—it’s the box.