Ledger crypto wallets compromised in hardware attack linked to $90M theft

Cryptocurrency hardware wallet maker Ledger is investigating an attack involving modified devices containing hidden surveillance components, with estimated losses exceeding $90 million.

The investigation has focused on Malaysian cryptocurrency retailer CryptoBilis, where customers began reporting missing funds on October 9. Blockchain researchers estimate that more than $90 million in digital assets has been stolen.

Ledger, the Paris-based manufacturer, said an organised criminal group had installed concealed hardware inside some of its wallets.

The company is also investigating reports of compromised devices purchased elsewhere, raising concerns that the attack may extend beyond CryptoBilis.

CryptoBilis has temporarily closed its physical stores in Kuala Lumpur. Ledger said it was working with local law enforcement, while the retailer has not commented.

Independent security researchers suggest the modified devices contain components capable of intercepting sensitive information transmitted to wallet screens and relaying it to attackers through cellular connections.

Such modifications could allow criminals to access cryptocurrency holdings without directly compromising the devices’ primary security chips.

The incident highlights concerns about supply-chain security in cryptocurrency storage, particularly when devices pass through third-party distributors or refurbishment channels.

Ledger’s investigation follows several other security incidents involving hardware wallet providers.

Earlier this year, a software vulnerability affecting devices manufactured by Coinkite reportedly resulted in approximately $130 million in Bitcoin losses.

Separately, a breach involving a shipping provider used by Trezor exposed personal information belonging to about 67,000 customers.

The investigation has also uncovered evidence of potentially compromised devices outside Malaysia.

An examination of a Ledger Flex purchased at Singapore’s Changi Airport reportedly identified a modified display connector, cellular chip, and SIM card.

The findings raise questions about how compromised devices entered retail distribution channels and whether additional customers remain exposed.

Ledger has yet to establish the full extent of the attack or disclose how many devices may have been affected.