A look at a coordinated theft of ~$100M in crypto using hardware backdoors planted in Ledger wallets sold by Malaysia-based authorized reseller CryptoBilis

The integrity of cryptocurrency hardware wallets is now demonstrably vulnerable through authorized resellers, directly impacting the security of your digital assets.

An estimated $100 million in cryptocurrency has been stolen following the discovery of hardware backdoors embedded in Ledger Nano X, Ledger Flex, and Ledger Stax wallets. The implants, found in devices sold by authorized reseller CryptoBilis in Southeast Asia and also in wallets purchased from a major European electronics chain, suggest a sophisticated attack targeting the cryptocurrency supply chain. The attackers are believed to be compromising wallets sold through legitimate channels to exploit customer trust and achieve wider distribution. Some stolen funds have reportedly been frozen or flagged for fraud, while investigations are ongoing. Ledger has requested CryptoBilis halt sales and has urged resellers to source products only through authorized channels and avoid reselling returned items, emphasizing the need for improved supply-chain integrity across the industry.

This coordinated theft marks a significant escalation in hardware-based crypto attacks, moving beyond unauthorized sellers to compromise trusted distribution channels. The sophisticated nature of the implants, capable of extracting seed phrases, indicates a deliberate effort to undermine the fundamental security premise of hardware wallets. The incident highlights a critical vulnerability in the hardware supply chain, a previously underestimated risk for users who rely on these devices for storing significant value.

The implications extend beyond Ledger users, signaling a potential systemic risk for the entire hardware wallet ecosystem and raising questions about the due diligence and security protocols of authorized resellers. Investors and consumers may need to re-evaluate their trust in hardware wallets and explore alternative security measures or verify device integrity more rigorously, potentially increasing the complexity and cost of securing digital assets.