Criminals Spent Millions Tampering With Ledger Crypto Wallets

Ledger says an organized crime group installed secret chips in its devices to steal crypto. Up to $86 million may have been drained.

Imagine buying a safe to protect your money — only to find out thieves had secretly rigged it before you got it. That's essentially what happened to some users of Ledger, a popular crypto storage device.

What is Ledger? Ledger makes "hardware wallets" (small physical devices, like a USB stick, that store cryptocurrency safely offline, away from hackers on the internet). They're considered one of the safest ways to hold crypto.

What went wrong? Ledger says a "highly organized criminal group" pulled off one of the most sophisticated attacks the crypto industry has ever seen. Here's how it worked:

The criminals bought genuine Ledger devices.
They installed secret hardware "implants" (hidden chips) inside them.
These implants could read the "seedphrase" (a secret list of words that acts like the master password to your crypto — anyone who has it can steal all your funds).
They then put the tampered devices back into the supply chain, selling them through resellers.

Key facts:

The problem was first spotted when customers in Southeast Asia lost money after buying from a Malaysia-based reseller called CryptoBilis.
A blockchain investigator named Specter estimates $86 million was stolen.
Ledger insists its own chips, software, and servers were NOT hacked — the attack happened after devices left its control, during distribution and resale.

What is Ledger doing? The company launched its "largest investigation to date," sending staff to Europe and other regions to check if more supply chains were affected. So far, screened devices came back clean. Resellers in Southeast Asia and Hong Kong have paused sales, and Ledger is working with police to "follow the funds" and shut down the criminals' operation.

The bigger picture: The crypto world has been rattled by major thefts lately. In July, hackers stole nearly $120 million from users of another wallet brand, Coldcard. There have also been several data breaches this year exposing customer information.

Bottom line: Even the most secure crypto devices can be compromised if criminals tamper with them before they reach you. Experts recommend only buying hardware wallets directly from the official manufacturer, not from third-party resellers.

This is an AI-generated summary. Read the original article at: https://bitcoinmagazine.com/news/ledger-says-crime-group-spent-millions