Ledger confirms an unauthorized hardware implant in devices linked to the theft of more than $86 million.
The mystery behind the massive draining of more than 300 wallets across $BTC Bitcoin, $ETH Ethereum, and $TRX Tron took a decisive turn with Ledger’s official statement. The company confirmed this weekend that one of the victims’ devices examined had been physically tampered with and contained an unauthorized hardware implant. According to the manufacturer’s report, all cases confirmed to date involved units sold by CryptoBilis, an official reseller operating in Indonesia, Malaysia, and the Philippines. Ledger ruled out any breach of its central servers or direct sales channels.
This discovery provides the first concrete evidence of what is known in cybersecurity as a supply chain attack. Unlike the usual cases of phishing or malicious contract signing, the attackers physically tampered with the devices before they reached their end customers, in order to clone or extract private keys. While independent researchers estimate the impact of the attack at between $86 million and $93 million, the regional distributor has suspended sales of its entire inventory, and local authorities are now investigating how the batch was physically altered.
Given the severity of the incident, Ledger issued a direct operational alert to any customer who purchased products through the distributor, advising them not to initialize devices that are still in their boxes and to urgently transfer their funds to a new seed generated on a device obtained directly from factory channels.
The incident has sparked a deep debate about the limits of self-custody, showing that even with high-security chips, the physical distribution chain remains a critical link that users must verify with extreme caution.
#news
The mystery behind the massive draining of more than 300 wallets across $BTC Bitcoin, $ETH Ethereum, and $TRX Tron took a decisive turn with Ledger’s official statement. The company confirmed this weekend that one of the victims’ devices examined had been physically tampered with and contained an unauthorized hardware implant. According to the manufacturer’s report, all cases confirmed to date involved units sold by CryptoBilis, an official reseller operating in Indonesia, Malaysia, and the Philippines. Ledger ruled out any breach of its central servers or direct sales channels.
This discovery provides the first concrete evidence of what is known in cybersecurity as a supply chain attack. Unlike the usual cases of phishing or malicious contract signing, the attackers physically tampered with the devices before they reached their end customers, in order to clone or extract private keys. While independent researchers estimate the impact of the attack at between $86 million and $93 million, the regional distributor has suspended sales of its entire inventory, and local authorities are now investigating how the batch was physically altered.
Given the severity of the incident, Ledger issued a direct operational alert to any customer who purchased products through the distributor, advising them not to initialize devices that are still in their boxes and to urgently transfer their funds to a new seed generated on a device obtained directly from factory channels.
The incident has sparked a deep debate about the limits of self-custody, showing that even with high-security chips, the physical distribution chain remains a critical link that users must verify with extreme caution.
#news