Ledger’s hardware-wallet security incident: What happened and what crypto users can do now

Ledger has confirmed that unauthorized hardware implants were used in genuine devices connected to the recent CryptoBilis wallet thefts in Southeast Asia. The implant could capture the 24-word recovery phrase displayed during setup and transmit it over a cellular connection. Reports of similarly modified devices later surfaced in Europe, prompting MediaMarktSaturn to remove Ledger products from sale.

Ledger has not yet confirmed a European fund drain as of October 15. Still, the incident was not a conventional compromise of Ledger’s Secure Element or operating system. It was a physical supply-chain attack. The attackers bypassed Ledger’s cryptographic protections by adding separate hardware capable of observing sensitive information displayed by a genuine device rather than breaking the Secure Element itself.

For crypto holders, the incident is a reminder that self-custody does not fully remove risk. Attackers do not need to defeat Ledger’s security architecture. Instead, they just need to find a way of going around it.

The first major security incident reports emerged on October 9, when users in Southeast Asia reported that crypto had disappeared from wallets. The common theme was that the Ledger devices had been purchased through CryptoBilis, a regional reseller.

Ledger confirmed an unauthorized hardware implant inside an affected device. According to the company’s investigation, the added circuitry sat inside the device enclosure and monitored information being sent to its screen.

This means an attacker did not need to extract private keys from Ledger’s Secure Element. During the initial wallet setup, a Ledger device displays a 24-word recovery phrase. The implant could recognize those words as they appeared on the screen, reconstruct the phrase and transmit it over LTE using an embedded eSIM. Once the attacker possesses that phrase, the original hardware wallet is no longer necessary. The same wallet can be recreated elsewhere and the assets transferred using the recovered keys.

The clever part was that the Ledger itself could continue doing exactly what it was supposed to do. The genuine device generated the recovery phrase as it should have. The genuine screen displayed it. The genuine Secure Element continued protecting the keys. A second piece of hardware simply watched from the background and waited patiently.
 

Ledger said the implant did not modify its Secure Element, operating system, transactions or signatures. Its investigation therefore characterized the event as a physical supply-chain compromise rather than a breach of Ledger’s internal systems or cryptography.

This is why the breach is different from other crypto thefts. The hardware wallet behaved normally without users realizing that a second piece of hardware was silently observing one of the most sensitive moments in the wallet’s lifecycle.

At first, Ledger said all confirmed losses were associated with devices sold through CryptoBilis in Southeast Asia. But reports soon after began appearing in Europe.

A user reported finding suspicious additional hardware in Ledger devices purchased from MediaMarkt stores in Germany. MediaMarktSaturn quickly removed Ledger devices from its stores and online platforms while the matter was investigated. Ledger also said it was examining reports involving implants in devices from other locations.

It is important to note that there remains an important distinction between confirmed losses and reported hardware tampering outside Southeast Asia.

As of October 15, Ledger had not publicly confirmed a European fund drain. Its latest description of the confirmed attack says modified devices were reintroduced into distribution through resellers in Southeast Asia. The reported European devices therefore broaden the supply-chain concern, but they do not yet prove that European customers were robbed through the same campaign.

One of the more unique aspects of the attack is what the attacker apparently chose not to hack. Hardware wallets are marketed around the idea that sensitive cryptographic material remains protected inside secure hardware and breaking into that hardware can be technically difficult.

So the attacker found a way around it. Rather than defeating the Secure Element, the implant watched the information being sent to the display. The recovery phrase appeared on the genuine Ledger screen. The Secure Element was genuine. Ledger’s software operated normally. Transactions still required normal confirmation.

But another component inside the device was essentially looking over the user’s shoulder. That creates a security distinction that is easy to miss: cryptographic authenticity and physical integrity are not the same thing.

Ledger’s own Donjon security documentation states that its Genuine Check verifies whether the Secure Element is genuine, but cannot detect unauthorized physical modifications, such as a spying implant, if the original Secure Element remains intact.

Stated differently, a device can contain a genuine Ledger security chip and still potentially contain something else. That is a much harder problem to detect than checking whether a product is counterfeit.

The uncomfortable reality is that “genuine” and “trustworthy” are not necessarily synonyms. A device can be genuinely manufactured by Ledger, contain a genuine Secure Element, pass cryptographic checks and still have been physically altered at any point between the factory and the user opening the box.

Security now has to include manufacturing, shipping, resellers, returns, warehousing, physical inspection and the moment the recovery phrase is first displayed. Total security is only as good as the weakest element.

Independent blockchain analytics firm Bitquery estimates that around $102 million was stolen from 324 wallets across six networks. That is not an official Ledger loss total, and blockchain clustering can change as investigators identify new addresses.

The transaction timing is particularly interesting. According to Bitquery, 25 TRON wallets authorized the same address within three seconds. Eight minutes earlier, another group of 30 wallets reportedly changed permissions to give an attacker-controlled key authority over the funds. On Bitcoin, Bitquery identified 111 wallets being emptied in a single block.

That level of synchronization is difficult to explain as hundreds of unrelated users independently falling for something at exactly the same time. Bitquery’s interpretation is that the attacker already possessed the credentials needed to control a large group of wallets and waited before executing the coordinated drain.

That suggests the operation may have had two very different phases. First, quietly collect access to wallets without giving victims a reason to suspect anything. Then, once enough credentials have accumulated, drain as many wallets as possible in the shortest amount of time before anyone realizes what has happened.

If that interpretation is correct, and there is no reason to assume otherwise, the moment users lost control of their wallets and the moment their crypto was stolen is not the same event. The compromise may have occurred days, weeks or even months before the theft became visible on-chain.

Bitquery also identified roughly two weeks of small test activity before the main theft. Its analysis traced assets through cross-chain swaps, Tornado Cash and Zcash, while Tether reportedly froze around $10 million in USDT associated with the incident.

This doesn’t prove that every wallet investigated was compromised by the same physical implant. But the timing is consistent with an attacker who had accumulated access before monetizing it.

Ledger now describes the attacker as a “highly organized criminal group.” In its October 15 update, the company said the group spent months buying genuine Ledger devices, installing custom-built hidden components and putting the modified devices back into distribution through resellers in Southeast Asia. Ledger also says the attackers built their own logistics, seed-collection, draining and laundering infrastructure.

The attacker needed substantial resources, physical access to legitimate products, telecommunications infrastructure, blockchain expertise, and the know-how to move tens of millions of dollars once the theft occurred.

Theory 1: A transnational organized-crime network

One possible scenario is a transnational organized-crime network with access to physical distribution and sophisticated cyber capabilities.

Over the past several years, the United Nations Office on Drugs and Crime has documented an increasingly sophisticated organized-crime ecosystem across East and Southeast Asia. Groups once associated mainly with casinos, drug trafficking and underground banking have expanded into industrial-scale online fraud, malicious applications, cryptocurrency services, cybercrime-for-hire and complex money-laundering networks.

UNODC describes a growing convergence between cyber-enabled fraud, underground banking, casinos, cryptocurrency and traditional organized crime.

A criminal group with existing access to logistics, grey-market electronics, cross-border commerce, or underground banking could have something purely remote hackers do not: access to the physical distribution chain.

That may be the most important capability of all. The technically impressive part of this attack was the implant, but the operationally difficult part may have been getting modified devices back into places where real customers would trust and buy them.

That regional context makes organized crime a plausible category to consider, but it does not establish that any organization documented by UNODC was involved in the Ledger attack.

Theory 2: North Korea

At the time of writing, there is no public evidence linking North Korea to the Ledger incident and there is no basis to attribute the attack to the DPRK from the available evidence. However, North Korean state-linked actors have repeatedly been attributed to major cryptocurrency thefts, including the $1.5 billion Bybit theft in February 2025.

North Korea’s intelligence and revenue-generation networks are documented across Asia. In 2025, the U.S. Treasury identified Nam Chol Ung as an officer of the Reconnaissance General Bureau, North Korea’s primary foreign intelligence service, and said he had operated businesses in Laos and Thailand for more than a decade to generate and launder foreign currency for the regime.

The point is not that this connects North Korea to Ledger. It shows that DPRK-linked operations already have personnel, facilitators and revenue-generation infrastructure in the same broader Southeast Asian environment where the confirmed Ledger campaign operated.

North Korea’s history of allocating substantial resources to cryptocurrency theft makes it relevant to the broader attribution discussion, but that history is not evidence of involvement here. Its crypto operations have included social engineering, compromised developers, fake employment, malicious applications and attacks on organizations surrounding the actual holder of funds.

However, the physical attack described by Ledger has not been part of the DPRK playbook. No public blockchain analysis has tied the stolen assets to previously attributed DPRK wallets or laundering infrastructure, and no investigator has reported hardware, telecommunications or logistics evidence pointing to North Korean actors.

That does not make North Korea’s involvement impossible, as its theft operations can evolve. It simply means there would need to be evidence beyond “North Korea steals crypto” before moving this theory higher up the list.

Theory 3: An intelligence service or state security organization

There is extensive historical precedent for intelligence services tampering with security hardware before it reaches its intended owner. Documents leaked by Edward Snowden indicated that the U.S. National Security Agency intercepted networking equipment during shipment, installed surveillance implants, repackaged the devices and allowed them to continue to their intended recipients.

More recently, the 2024 pager operation targeting Hezbollah demonstrated another form of supply-chain interdiction. Thousands of pagers used by Hezbollah exploded in Lebanon after devices had reportedly been modified before reaching their users.

The similarity to the Ledger attack is limited to the method of physical interdiction: an attacker can compromise a device before the victim receives it and allow that device to behave normally until the hidden capability is used.

Many intelligence agencies possess sophisticated hardware teams, covert procurement capabilities, front companies, logistics access, and the ability to manufacture custom implants. In theory, stolen cryptocurrency could also provide difficult-to-trace operating funds, but there is no evidence that this was the purpose of the Ledger operation.

Stealing consumer crypto purely to finance intelligence operations would be difficult to justify from the available evidence. The more interesting comparison is methodological: physical supply-chain interdiction requires precisely the kind of patience, logistics and hardware expertise historically associated with intelligence and military tradecraft.

While state actors can’t be fully ruled out, another possibility is that former intelligence, military, or government cyber personnel could have been involved independently or as contractors. Former intelligence operators could bring the necessary skills into a criminal operation after leaving public service.

Theory 4: An ‘Ocean’s Eleven’-style heist

Perhaps there was no North Korean involvement, intelligence service, or large global crime syndicate behind the attack at all.

Instead, the operation could have been assembled around a small group of specialists, each responsible for one part of the heist. A hardware engineer designs the implant, someone with access to distribution or returns channels covertly places the modified devices, a telecommunications specialist manages the cellular exfiltration, a crypto operator monitors the compromised wallets, and a laundering specialist moves the funds once the theft is complete.

While this sounds like a Hollywood movie, the underlying division-of-labour model is well documented in cybercrime. Europol describes crime-as-a-service ecosystems in which specialized criminal capabilities can be bought, sold, or combined, allowing groups to assemble expertise they do not possess internally.

That does not establish that the Ledger operation was assembled this way, but it provides a plausible model for how a relatively small group could combine several highly specialized capabilities.

The usual hardware-wallet security model tends to focus on a handful of questions: Is the Secure Element genuine? Does the private key remain offline? Did the user protect the recovery phrase? Can malware sign a transaction without physical confirmation?

The aftermath of the Ledger incident introduces a new question: what if the cryptography works, the Secure Element works, the user follows all available best practices, but the physical device itself was compromised somewhere along the way?

That means hardware-wallet security is better understood as a chain: manufacturing → distribution → physical integrity → initialization → recovery-phrase generation → recovery-phrase storage → transaction signing → eventual recovery. An attacker does not need to defeat every link. One successful interception can be enough.

This does not mean hardware wallets are fundamentally unsafe. It means their security cannot be reduced to a secure chip and a slogan about keeping keys offline.

A Ledger purchased directly through an unaffected sales channel is not automatically compromised. But, if users have reason to suspect otherwise or want to take an extra step to safeguard their assets, there are some steps that can be taken.

The priority is the assets, not the hardware, so changing the Ledger PIN or updating the firmware would not address a recovery phrase that has already been exposed. If there is a reasonable basis to suspect that a modified device captured the recovery phrase, users should treat that phrase as compromised.

Remaining assets can instead be transferred to an address controlled by an entirely new set of keys. That could mean a newly initialized hardware wallet using a completely new recovery phrase, or another custody arrangement, including a custodial account on a regulated crypto trading platform.

Users should also stop depositing additional crypto into addresses derived from the potentially exposed recovery phrase.

If the immediate problem is that a self-custody recovery phrase may be compromised, moving assets to a custodial platform like Ndax changes the key-management model because the individual customer is no longer relying on that exposed seed to control the assets held on-platform. It does not remove custody risk; it replaces personal key-management risk with a custodial framework and its associated platform, operational and counterparty risks.

For Canadian users, Ndax represents one alternative to managing a single hardware-wallet seed personally. Crypto left on Ndax does not depend on an individual customer safeguarding one 24-word recovery phrase.

Ndax’s Custody Disclosure Statement is straightforward: no less than 80% of client virtual assets are held in cold and warm storage with acceptable third-party custodians regulated as trust companies. The remainder can be held temporarily through Ndax’s own custody infrastructure in hot wallets to support deposits, withdrawals, trade settlement, liquidity-provider activity and certain staked assets.

Coinbase Custody Trust Company and BitGo Trust Company are Ndax’s third-party custodians. Assets held with third-party custodians are maintained in segregated omnibus accounts in Ndax’s name in trust for or for the benefit of clients and are kept separate from assets belonging to Ndax, its affiliates and other clients of the custodians. Ndax also states that it reconciles virtual assets held with custodians and within Ndax-controlled wallets against its books and records on a monthly basis.

Ndax’s additional controls include multi-party computation, multi-signature technology, geographically separated secure storage of private keys and safeguards intended to reduce single-point-of-failure risk.

Crypto security has historically operated under a simple rule: “not your keys, not your coins.”

This is an important feature of self-custody and means that when a user controls their keys, they also take responsibility for the system used to protect those keys. In practice, that can include reliance on the hardware manufacturer, software, distribution channel and physical integrity of the device.

The Ledger incident does not make that principle wrong. It shows why the simplified version of it is incomplete. Key ownership may remove dependence on a custodian, but it does not remove dependence on everything involved in generating, displaying, storing and using those keys.

Custodial platforms provide a different security model. Users give up direct control of private keys in exchange for an institutional custody architecture, account recovery mechanisms, internal controls and regulated operational processes. That introduces platform and counterparty risk.

That does not make institutional custody the better option by default for all users. It just means the security problem is managed differently and neither option should be evaluated with slogans.

And that is perhaps the broader lesson of the Ledger attack. Crypto can make the ownership layer cryptographically verifiable while still depending on an extraordinarily physical world of factories, chips, resellers, couriers, warehouses, employees and devices that someone eventually has to trust.

The Ledger incident did not demonstrate that hardware wallets as a whole are flawed. It demonstrated what was already known but overlooked by some: even the strongest cryptography can be bypassed if an attacker compromises another vulnerable part of the trust chain.

An attacker did not need to break Ledger’s Secure Element to steal funds. It only needed to see the recovery phrase that the legitimate device displayed.

For users who do not want to carry all of those responsibilities personally, a regulated custodial model such as Ndax provides a different approach. For users who prefer self-custody, the Ledger incident is a reason to examine the entire lifecycle of a hardware wallet, not simply whether the device passes an authenticity check.

Regardless of what a user decides, the main lesson is the same: custody does not remove trust. It determines where that trust is placed.