Ledger, a leading cryptocurrency hardware wallet manufacturer, is probing a sophisticated attack involving tampered devices that have led to an estimated $90 million in stolen digital assets. The investigation centers on CryptoBilis, a Malaysian cryptocurrency retailer, where customers first reported missing funds on October 9. Ledger suspects an organized criminal group installed hidden surveillance components within some of its wallets, allowing attackers to intercept sensitive information and access users' cryptocurrency holdings.
The compromised devices reportedly contain modified components capable of relaying intercepted data to attackers via cellular connections. This method bypasses the primary security chips, raising serious concerns about supply-chain security in cryptocurrency storage. Ledger has also identified potentially affected devices purchased outside Malaysia, including a Ledger Flex bought at Singapore’s Changi Airport, which contained a modified display connector, cellular chip, and SIM card.
CryptoBilis has temporarily closed its physical stores in Kuala Lumpur, while Ledger is collaborating with local law enforcement to uncover the full extent of the attack. The incident follows other security breaches in the industry, including a software vulnerability in Coinkite devices that resulted in approximately $130 million in Bitcoin losses and a Trezor breach exposing personal information of about 67,000 customers.
The findings highlight vulnerabilities in the cryptocurrency hardware wallet supply chain, particularly when devices pass through third-party distributors or refurbishment channels. Ledger has yet to determine how many devices may have been compromised or how the tampered devices entered retail distribution channels.