Ledger Hardware Wallets Hit by Supply Chain Attack: Millions Drained via Physical Spy Chips
A significant supply chain attack targeting Ledger hardware wallets, distributed through Southeast Asia’s authorized reseller CryptoBilis, has resulted in substantial financial losses for cryptocurrency users. Threat actors managed to compromise physical devices, intercepting recovery seed phrases during the initial setup process and subsequently draining an estimated $86 million to over $93 million from more than 300 affected wallets. The incident, which reportedly occurred between October 9 and 11, 2026, highlights a disturbing new frontier in hardware security exploits.
The Sophisticated Hardware Implant
Unlike traditional cyberattacks that target software or firmware, this breach involved a highly sophisticated physical tampering of the hardware wallets themselves. Reports indicate that attackers intercepted batches of Ledger devices destined for CryptoBilis, an official reseller covering markets including Malaysia, Indonesia, and the Philippines. They then physically soldered malicious hardware implants, described as spyware chips, onto the device circuit boards. These chips were strategically placed to passively intercept the 24-word recovery seed phrases as they were displayed on the device’s screen during the crucial initialization process.
Crucially, the attack bypassed Ledger’s built-in security measures, including the device’s certified Secure Element chip and its ‘Genuine Check’ software verification. Users initializing these compromised wallets believed their devices were secure and authentic, only to discover their funds missing weeks or months later, often after accumulating significant balances. The compromised seed phrases were exfiltrated via cellular networks, allowing the attackers to gain full control over the users’ digital assets.
Ownership Transfer Allegations
Industry figures and security researchers have highlighted claims that the attackers may have acquired control of the reseller prior to the incident, using non-disclosure agreements to conceal the ownership change. Former CryptoBilis founders clarified they had handed over operational control in March 2026 and were barred by a non-disclosure agreement from publicly announcing the ownership transfer until mid-October 2026, while denying involvement in the breach.
Official Responses and User Warnings
Ledger has confirmed that its own internal systems, manufacturing supply chain, and direct sales channels were not breached. The compromise is specifically isolated to devices that passed through the affected reseller’s distribution network. In response, Ledger has instructed CryptoBilis to immediately halt all sales and shipments of hardware wallets while a thorough investigation, in collaboration with law enforcement, is conducted.
CryptoBilis has complied with these instructions, ceasing all hardware wallet inventory sales. Tether has also stepped in to freeze approximately $10 million in USDT associated with known attacker addresses, though portions of the stolen funds have already been routed into mixing services like Tornado Cash.
Urgent Advisory: Users who purchased a Ledger device from CryptoBilis within the last 90-120 days are strongly advised NOT to set it up or power it on. For those already using initialized devices bought via CryptoBilis, security experts warn that the recovery seed should be treated as compromised. These users must immediately transfer all funds to a secure, clean wallet with a newly generated seed phrase and contact Ledger Support.
Why it matters
This breach exposes a critical vulnerability in the cryptocurrency ecosystem: the physical supply chain. While blockchain networks themselves are highly secure, the hardware gateways used to access them are susceptible to tampering if not rigorously monitored from factory to consumer. This incident serves as a stark reminder that even the most robust digital security measures can be circumvented through physical means.
For the Malaysian and broader Southeast Asian crypto community, the breach shatters trust in local distribution networks. It underscores the necessity of purchasing hardware wallets directly from manufacturers whenever possible, or verifying the unbroken chain of custody through authorized resellers. The magnitude of the losses—nearly $100 million—will likely prompt regulatory scrutiny and demand stricter security auditing for crypto hardware distributors, reshaping how these essential security tools are sold and delivered globally.
Internal links: How Malaysia’s Payment System Works · E-Wallets in Malaysia.
Sources: The Hacker News, The Defiant, The Star, Bitquery, TradingView, Global Sources (October 2026).
