Paris-based Ledger built its name on devices that promised to keep crypto holdings beyond the reach of hackers. That promise took a hit last week. Users in Southeast Asia who bought Ledger hardware wallets from an authorized reseller discovered their funds gone. Analysts tracking the blockchain put losses north of $93 million. And Ledger itself confirmed something alarming.

One of the affected devices held an unauthorized hardware implant. The company said so in an update on X. Photos circulating online show a small circuit board tucked under the screen. It appears capable of capturing the recovery phrase displayed during setup. An embedded SIM card then beams the data to attackers. Funds vanish soon after.

The Verge first detailed the suspected tampering on October 10. It reported an $86 million supply chain attack tied to the implants. Ledger had already moved to contain the damage. It instructed the reseller, CryptoBilis, to stop selling and shipping all Ledger products. Buyers from the past 90 days received clear orders. Don’t set up the device if still in the box. Those who completed setup should move assets to a fresh Ledger with a new seed phrase.

But the numbers kept climbing. On-chain researcher Specter traced inflows to theft addresses from hundreds of wallets. The total sat above $86 million at first, spanning Ethereum, Tron and Bitcoin. Bitquery later counted $93.2 million taken from 315 wallets across six chains. Tron USDT dominated the haul. Bitcoin transfers added tens of millions more. Tether froze roughly $10 million in linked USDT. Some ether moved through Tornado Cash before reappearing in new addresses.

Decrypt covered the probe on October 9. It noted Ledger’s request to CryptoBilis and the advice to recent purchasers. The reseller operates in Indonesia, Malaysia and the Philippines. No signs point to a breach of Ledger’s own systems or factory-sealed devices sold directly by the company. The problem sits in the distribution channel. One vendor. One point of compromise.

CoinDesk reported the same day. Pseudonymous investigator Specter flagged the drains after users posted on X and Reddit. He listed several theft addresses. Arkham Intelligence data showed nearly $87 million at those points early on. Changpeng Zhao, Binance’s founder, weighed in. He called it a localized supply chain attack involving one vendor. A small number of people likely bought fake or tampered units.

Mark Karpelès added detail. The former Mt. Gox chief has examined suspect Ledger devices for weeks. He posted images of a Nano X bought in Malaysia. The packaging looked factory fresh. Yet inside sat a mobile data chip, antenna, eSIM and controller wired into the unit. The module sits behind the screen. It can intercept whatever appears there, including the 24-word recovery phrase shown once during initialization. SlowMist’s chief information security officer speculated the implant records the phrase then transmits it over cellular.

Ledger’s October 10 statement went further. It confirmed the implant in one impacted user’s device. The company is contacting affected customers. It opened its bounty program for tips. [email protected]. Collaboration with authorities continues. SEAL_911, a security alliance, assists the probe. CryptoBilis ceased sales as a precaution. Ledger stressed no compromise of its infrastructure, systems or services.

Preparation stretched weeks. TokenPost reported on October 11 that attackers tested transfers, approvals and automated movements beforehand. Wallets drained ranged from days old to over five years. One pattern stood out. Multiple wallets signed identical requests within seconds. It suggested a single operator holding all the keys. Not random phishing. Coordinated execution.

The incident echoes past troubles. Ledger faced criticism years ago over a data breach that exposed customer emails. It survived. Hardware attacks differ. They strike before the user even powers on the device. Physical access during resale lets attackers insert components that bypass software checks. Users follow every protocol. They write down the phrase. They store it offline. None of it matters if the hardware leaks the phrase at the critical moment.

Bitquery’s investigation showed 1,254 ETH routed through mixers. Some USDC remains where Circle could still freeze it. The bulk on Tron moved fast. One thief. All the keys. That fact limits the number of bad actors but raises questions about how the tampered devices reached legitimate buyers through an authorized channel.

Industry watchers point to the reseller’s recent ownership change. Reports mention a new Chinese buyer took control of CryptoBilis in March. Former owners lost access by August. Details remain thin. Ledger has not commented on the ownership shift. Its focus stays on the technical findings and customer remediation.

Advice from the company remains direct. Buy direct when possible. Verify packaging. But even sealed boxes proved vulnerable in this case. Karpelès urged owners of suspect devices to send photos of their circuit boards. The community responded with images. Some show extra wiring. Others appear clean. Distinguishing tampered units without disassembly is difficult.

Hardware wallets exist to remove trust from online services. They keep keys offline. Yet this attack shows the supply chain itself can become the weak link. Attackers don’t need to hack Ledger’s servers. They insert themselves earlier in the journey from factory to customer. A single reseller becomes the vector for nine-figure losses.

Ledger says it continues adding security measures. Enhanced anti-tampering solutions are in development. The statement reads like an acknowledgment that current protections fell short for devices passing through third-party hands. Users who bought elsewhere report no issues. The problem appears contained to CryptoBilis sales.

Still, trust erodes fast in crypto. One confirmed implant validates the fears of many. If it happened once through an authorized seller, could it happen again? Ledger’s direct sales channel now carries extra weight. So does the call to generate new seeds and migrate funds.

On-chain totals vary slightly by source. Bitquery’s $93.2 million figure from October 10 stands as one of the highest. Earlier estimates from Specter and tanuki42 started lower. The discrepancy comes from additional chains and addresses identified later. Polygon, BNB Chain, Solana and Base saw smaller drains. The core activity concentrated on Tron and Bitcoin.

Investigators continue to watch the theft addresses. Some funds sit unmoved. Others have been swept. Tether’s freezes removed a chunk of liquidity for the attackers. Yet much of the haul likely remains accessible. Recovery chances dim once assets leave identifiable addresses.

The episode serves as a reminder. No storage method is foolproof. Hardware reduces certain risks. It introduces others tied to physical integrity and distribution integrity. Users must weigh those trade-offs. Ledger now faces the task of rebuilding confidence among Southeast Asian customers and beyond.

It works with authorities to identify those responsible. A bounty seeks outside help. The company promises updates. For now, the message to anyone who bought from CryptoBilis is unambiguous. Treat the device as compromised. Start fresh. And perhaps rethink where the next hardware wallet comes from.