Ledger Hardware Wallets Compromised in Supply Chain Attack Resulting in $93.4 Million Losses

This incident highlights vulnerabilities in hardware wallet distribution, potentially undermining user trust in cryptocurrency security.

• On October 9, 2026, reports emerged of significant cryptocurrency drains from Ledger wallets linked to purchases from Southeast Asian reseller CryptoBilis.
• Estimated losses reached $93.4 million, affecting 471 addresses, primarily in USDT on Tron, Bitcoin, and Ethereum.
• Ledger has paused sales through CryptoBilis and is investigating the incident while advising users to refrain from setting up their devices.

• Recent breaches: This incident follows data breaches at competitors like Trezor and Safepal, raising concerns about hardware wallet security.
• Supply chain vulnerabilities: The involvement of third-party resellers like CryptoBilis complicates the integrity of hardware wallets before they reach consumers.
• Cross-chain laundering: Analysts have identified sophisticated laundering techniques, indicating a well-organized attack rather than random theft.

On October 9, 2026, the cryptocurrency community was rocked by reports of significant losses linked to Ledger hardware wallets purchased from the Southeast Asian reseller CryptoBilis. Initial estimates of losses were around $86 million, but on-chain analyses refined this figure to approximately $93.4 million across 471 addresses. The primary assets affected were USDT on the Tron blockchain, Bitcoin, and smaller amounts on Ethereum.

Ledger, a prominent player in the hardware wallet market, quickly responded by pausing all sales and shipments through CryptoBilis and advising users who purchased devices in the last 90 days to avoid setting them up or transferring assets. This swift action indicates the seriousness of the situation and the potential for a supply chain attack, where unauthorized access to recovery phrases or signing keys may have occurred.

Independent blockchain analysts, including Specter and John Kamal (Yfarmx), have been instrumental in tracing the funds and identifying patterns consistent with a single actor controlling multiple wallets. The investigation revealed that funds were moved through cross-chain operations, including the use of Tornado Cash, a service known for obfuscating transaction origins. Tether, the issuer of USDT, has already frozen approximately $10 million linked to the stolen funds, showcasing the immediate response from the crypto ecosystem to mitigate further losses.

The incident raises critical questions about the integrity of hardware wallets, especially when third-party resellers are involved. CryptoBilis, while an authorized distributor, also sells competing brands, which complicates the narrative around device security. The community is now left waiting for a formal postmortem from Ledger, which could provide more clarity on whether the issue stemmed from tampering or a remote exploit.

As the investigation unfolds, the implications for hardware wallet security and user trust in cryptocurrency are profound. Users are left to wonder about the safety of their assets and the reliability of the devices they rely on for secure storage.

• Cryptocurrency investors: Users who purchased Ledger wallets from CryptoBilis are at immediate risk of losing their assets.
• Hardware wallet manufacturers: Companies like Ledger may face reputational damage and decreased sales as trust in their products wanes.
• Regulatory bodies: Increased scrutiny on hardware wallet security and supply chain practices may lead to new regulations in the cryptocurrency space.

• Ledger's investigation outcomes: The results of Ledger's inquiry will be crucial in determining the cause of the incident and restoring user confidence.
• Market reactions: Watch for shifts in hardware wallet sales and user behavior in response to this incident, particularly among Southeast Asian consumers.
• Regulatory developments: Increased regulatory attention on hardware wallet security could lead to new standards and practices in the industry.