Ledger crypto wallets compromised in hardware attack linked to $90M theft

Cryptocurrency hardware wallet manufacturer Ledger is investigating a sophisticated attack that resulted in losses estimated at over $90 million. The breach, which centered around modified devices in Malaysia, has raised serious concerns about supply-chain security for cryptocurrency storage. CryptoBilis, a Malaysian retailer, was hit hard, with customers reporting missing funds starting October 9. Blockchain experts estimate that more than $90 million in digital assets were stolen.

Ledger, a Paris-based firm, disclosed that a criminal organization had embedded hidden hardware into certain wallets. The company is also looking into reports of compromised devices bought from other sources, suggesting the attack may not be limited to CryptoBilis. The firm has been cooperating with local law enforcement, while the retailer has not issued a statement.

Independent researchers propose that the tampered devices contain components capable of intercepting sensitive data from the wallet screens and transmitting it to attackers via cellular connections. This implies that criminals could potentially access cryptocurrency holdings without directly tampering with the devices' main security chips. The incident underscores the need for robust supply-chain security in the cryptocurrency sector, especially when products undergo third-party distribution or refurbishment.

Ledger's probe comes after several other security breaches involving hardware wallet suppliers. In the same year, a software flaw in Coinkite devices led to around $130 million in Bitcoin losses. Additionally, a breach linked to a shipping company used by Trezor exposed personal data of approximately 67,000 customers. The investigation has also revealed evidence of potentially compromised devices outside Malaysia.

A Ledger Flex unit bought at Singapore's Changi Airport was found to have a modified display connector, a cellular chip, and a SIM card.

The findings cast doubt on how these devices could have infiltrated retail channels and whether more customers may still be at risk. Ledger has not yet determined the full scope of the attack or the total number of potentially affected devices.