Ledger says a highly organized criminal group spent millions of dollars on a supply-chain attack that planted hardware implants in its devices to harvest users' seed phrases. Blockchain investigator Specter estimates $86 million has been drained from affected wallets — a figure Ledger has not confirmed, and one the company did not address when asked in writing.

The Paris-based hardware manufacturer disclosed the operation in a statement Thursday, calling it one of the most sophisticated attacks the digital asset industry has experienced. According to the company, the criminal group purchased genuine Ledger devices, installed implants capable of reading seed phrases, and returned the tampered units to the supply chain through resellers.

"They were patient, they spent millions, and they struck in one coordinated operation, draining wallets," Ledger said in the statement. The company described attacker infrastructure that included seed collector servers plus dedicated draining and laundering systems.

Ledger was blunt on the question of internal fault. "There was no flaw in Ledger's chip, operating system or servers. Ledger's systems were not compromised. This was an attack on the distribution channel after the devices left our control," the company said. That framing places responsibility on the reseller layer — a layer Ledger authorizes but does not directly operate.

How did the attack surface?

The investigation began after customers in Southeast Asia reported fund losses following purchases from CryptoBilis, a Malaysia-based reseller. Ledger subsequently confirmed that one impacted user's device contained an unauthorized hardware implant. The company did not disclose how many customers were targeted, and its statement leaves the total number of tampered devices in circulation unaddressed.

For scale: $86 million is roughly what the average American household would need more than 1,200 years to earn at median income. It also approaches the losses from the July breach at Coldcard, where hackers stole close to $120 million in bitcoin from users of that hardware wallet.

What is Ledger doing now?

In what it called its largest investigation to date, Ledger sent employees to other markets, including Europe, to check whether additional supply chains had been compromised. The company reported that screened devices came back clean.

Authorized resellers and distributors in Southeast Asia and Hong Kong have suspended sales while the review proceeds. Ledger said it is working with law enforcement to follow the funds and dismantle the attackers' infrastructure. It has not named the agencies involved or any jurisdiction where charges may be filed.

The episode follows a separate pressure point: scammers earlier this year obtained Ledger customer information through the company's payment processor, Global-e. No connection between that data breach and the implant operation has been established.

What remains unresolved?

Three gaps stand out. Ledger has not confirmed the loss figure, stated the number of victims, or explained how tampered devices re-entered authorized reseller channels without detection. Until those questions are answered, the company's claim of a clean core product rests on its own screening alone.

The takeaways, in plain terms: the devices were genuine, the channel was not, and customers who bought through resellers in the affected regions bore the cost. Whether Ledger's reseller vetting changes — and whether law enforcement recovers any of the estimated $86 million — will define the next phase of this incident.

By Elena Vasquez