Reports about wallet-draining by Ledger users. Total losses $86M+

[Pmalek]

If you buy direct from Ledger, you get your name and home address leaked. If you buy from an authorized reseller, you get a hacked device. You're screwed either way.

I agree with the first part of your sentence, but the second part shouldn't be specific and target one brand. In this case, Ledger.

Someone posted an image earlier with the names of hardware wallets that this Asian reseller sells. Whether they are official resellers of all those brands or just some, I don't know. The point is, they could have sold manipulated devices from any of those brands. The reason it was Ledger is surely because of its popularity, regardless of the drama they have caused lately. It makes little sense from a scammer's point of view to put implants in hardware wallets that don't sell well. They want the biggest possible list of potential victims. That doesn't mean that the same thing couldn't have happened to any of the other hardware wallet brands out there.

[Wind_FURY]

hmmm looks like trezor will be next.

I shifted some coins about we will see what is next to get stolen.

I just noticed your post, and SER, don't spread FUD like that. Everyone is already getting paranoid.

 

Everyone keeps blaming Ledger for the attack, but everyone didn't notice that the reseller "CryptoBilis" also SELLS OTHER HARDWARE WALLETS, including the Trezor.

   ¯\_(ツ)_/¯

Probably anyone in that region who bought hardware wallet in this year should move their crypto somewhere, better be safe than sorry!

Even though it's hard to believe if the reseller had planted the same supply chain attack to other type of hardware wallet, they decided not to drain other wallet as well.

This kind of attack could only be executed once, after the reputation blew up everybody would've become alerted and take precaution such as migrating their money to CEX.

But i'd prefer to move over my crypto elsewhere over having paranoid thoughts any day if I were in that situation.

Because of my "hardware wallet implanted" paranoia, I actually tried to open my Trezor Safe 3 that I have NEVER used because the glue/resin on the box didn't stick when I opened it. BUT it's good to find out that it's actually HARD to open a Trezor Safe 3. You need to either break the casing or use special tools to disassemble it without leaving traces that it was tampered.

[LuckyCrypto777]

Ledger also has resellers who, due to regional proximity, could also pose a threat due to potentially altered technical design.


Source

I agree with the first part of your sentence, but the second part shouldn't be specific and target one brand. In this case, Ledger.

Someone posted an image earlier with the names of hardware wallets that this Asian reseller sells. Whether they are official resellers of all those brands or just some, I don't know. The point is, they could have sold manipulated devices from any of those brands. The reason it was Ledger is surely because of its popularity, regardless of the drama they have caused lately. It makes little sense from a scammer's point of view to put implants in hardware wallets that don't sell well. They want the biggest possible list of potential victims. That doesn't mean that the same thing couldn't have happened to any of the other hardware wallet brands out there.

Well, I understand your logic, but on the other hand, it would also make sense for attackers to change the device inside expensive hardware wallets... after all, those Bitcoiners who have a lot of Bitcoins will prefer expensive hardware wallets.

[julerz12]

Mark Karpeles continues to investigate the case and, in the following tweet, shows how the spy implant was soldered onto the Ledger circuit board and which testpads it was connected to. apparently, there were two different versions...
for anyone who’s into this and 'understands' circuit boards, these images and this tweet are certainly very interesting.

I opened my 6-year-old Ledger Nano S today following that guy's recent guide. I bought this around 2019~2020 from CryptoBilis.
IDK, it looks clean? The problem is I can't find a genuine image of this type of PCB on the Ledger site; the only version they have on their site is for the Ledger Nano S Plus. If anybody has the same type of Ledger and could provide an image of their PCB, that'll be great to compare with.


[EDIT] I asked Mark Karpelès on X and he said everything looks fine.  
https://x.com/Julerz5853/status/2109277306074333587

BTW, it seems someone from Europe also found something hidden in his Ledger device: https://x.com/0xJohannes_/status/2109240472933671125
Purchased a couple of weeks ago from an official reseller in Europe.

[Wind_FURY]

Mark Karpeles continues to investigate the case and, in the following tweet, shows how the spy implant was soldered onto the Ledger circuit board and which testpads it was connected to. apparently, there were two different versions...
for anyone who’s into this and 'understands' circuit boards, these images and this tweet are certainly very interesting.

I opened my 6-year-old Ledger Nano S today following that guy's recent guide. I bought this around 2019~2020 from CryptoBilis.
IDK, it looks clean? The problem is I can't find a genuine image of this type of PCB on the Ledger site; the only version they have on their site is for the Ledger Nano S Plus. If anybody has the same type of Ledger and could provide an image of their PCB, that'll be great to compare with.


[EDIT] I asked Mark Karpelès on X and he said everything looks fine.  
https://x.com/Julerz5853/status/2109277306074333587

BTW, it seems someone from Europe also found something hidden in his Ledger device: https://x.com/0xJohannes_/status/2109240472933671125
Purchased a couple of weeks ago from an official reseller in Europe.

The ability to physically open the Ledger easily has its pros and cons. It's very good for us PLEBS because we could check if there's an implant. But it's also very bad because it's easier for bad actors to put implants.

I have a Trezor Safe 3  that I couldn't physically open, and THAT makes me paranoid. What if bad actors with special tools could open it?

[Faisal2202]

Because that worked so well for Coldcard users. At this point, you’re better off just not using a hardware wallet. The average user simply lacks the ability to verify, not trust with these devices.

I was thinking, what if they fix the weight of the hardware wallet? Like, the X model will weigh X grams, and they leave no room for removing anything. So a new buyer will only have to check the weight of the device, and if it's off for that specific model, they can know someone has tampered with it.

I know it can be a stupid idea, and it's not something so unique that only came to my mind. Ledger must be thinking of something to avoid tampering at this level, which they will eventually do. But most Bitcoiners are using hardware wallets, if I am not wrong, and they are all vulnerable. The person behind this waited all this time, so what if the creators or tamperers of your hardware wallets are also waiting? That's why the idea of moving funds to centralized exchanges and banking services is increasing, and people are genuinely looking into this. They won't leave crypto, but they will advance, and therefore, these giant, famous companies have to improve their security first.

Also, they can make their devices visible, so we can look directly through a transparent body, or make a layout verification system so easy for new buyers that they can open and close the hardware wallet and confirm within minutes whether it has been tampered with or not.

I am just thinking about the worst-case scenario here. We always thought they couldn't confiscate everything, but even if they confiscate 50% like this, the impact can be huge, and the rest will follow on their own, like herd mentality.

[philipma1957]

Mark Karpeles continues to investigate the case and, in the following tweet, shows how the spy implant was soldered onto the Ledger circuit board and which testpads it was connected to. apparently, there were two different versions...
for anyone who’s into this and 'understands' circuit boards, these images and this tweet are certainly very interesting.

I opened my 6-year-old Ledger Nano S today following that guy's recent guide. I bought this around 2019~2020 from CryptoBilis.
IDK, it looks clean? The problem is I can't find a genuine image of this type of PCB on the Ledger site; the only version they have on their site is for the Ledger Nano S Plus. If anybody has the same type of Ledger and could provide an image of their PCB, that'll be great to compare with.


[EDIT] I asked Mark Karpelès on X and he said everything looks fine.  
https://x.com/Julerz5853/status/2109277306074333587

BTW, it seems someone from Europe also found something hidden in his Ledger device: https://x.com/0xJohannes_/status/2109240472933671125
Purchased a couple of weeks ago from an official reseller in Europe.

The ability to physically open the Ledger easily has its pros and cons. It's very good for us PLEBS because we could check if there's an implant. But it's also very bad because it's easier for bad actors to put implants.

I have a Trezor Safe 3  that I couldn't physically open, and THAT makes me paranoid. What if bad actors with special tools could open it?

Maybe it was glued shut by a tamper.

I own trezor 1 these are old really old maybe 2016 direct from trezor I trust these.
I own trezor 3 this has solana staked I kind of trust it.
I own trezor 5 btc only I no longer trust this one.

My funds are in a core wallet
My funds are in trezor 1
My small funds are in the trezor 3 and 5

And some in kraken and robinhood

I leave smaller money in the trezor 5 and 3 as canaries to detect theft.

[Richy_T]

The things I see people say to defend Ledger Recover make my jaw drop. "It's only active if you enable it." Prove it. The code is closed source. Even Ledger has admitted they can't prove their code has no backdoors.

If it is something that is only available when the keys are first created, I could see that being reasonable (though still a bad idea). If it can be activated at any time, that's definitely a bad sign.

I'm actually thinking about how the SIM has unlimited data internet?  My mind tells me if I have this, I might use that SIM card for unlimited internet if it exists. What do you think? It's free data lifetime.

It's likely for a limited amount of data or time. I have never seen an unlimited forever for sale.

Uh, has there been any evidence that there are bands of people roving around, breaking into people's homes, searching carefully, potentially for hours through possibly many rooms for a device that may not even be present and then carefully swapping it out for an identical looking device and then carefully exiting, leaving no trace? This is nonsense.

[mikel_012]

I have a Trezor Safe 3  that I couldn't physically open, and THAT makes me paranoid. What if bad actors with special tools could open it?

You can open the Trezor very easily but not just with your hands

In this video someone opened the Trezor to connect with the chip and recover millions recovering the PIN, you can see it was very easy to open in the first 20 seconds of the video: https://www.youtube.com/watch?v=dT9y-KQbqi4

They can glue the case again and it will look like it was never messed

[Richy_T]

By the way, as far as I know, Ledger never used anything of the sort, but times have changed, and the presence of "new integrated components installed by malicious actors to steal funds from wallet owners" will force the implementation of new measures.

There is only so much can be done. Even genuine hardware could be compromised. Substituting a week random number generator would be enough to make something indistinguishable from the original while providing an easily searchable keyspace.  

SeedSigner hardware, running the ShieldSigner fork. In 2026, that's as good as it gets in terms of security. Nothing is better, at any price. And for your seed phrase: Metal backup, secured in a safe with a home automation sensor that notifies you instantly if the safe is opened or moved. The home automation will cost less than $60.

Additional suggestion for this: Have a pre-signed transaction that transmits those funds to an alternate address which is broadcast if the safe is opened.

[NABiT]

72 hour update on reseller CryptoBilis incident

"To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis"

https://x.com/Ledger/status/2109331538072494364?s=20

[Richy_T]

The ability to physically open the Ledger easily has its pros and cons. It's very good for us PLEBS because we could check if there's an implant. But it's also very bad because it's easier for bad actors to put implants.

Bad actors will have tools to open the case easily or even have replacement cases made. For the Nano, the OLED screen dims eventually and needs replacement so the easily openable case is convenient.

[Hispo]

All of this is quite sickening...
And honestly, it makes me nervous and paranoid on everything which may have something to do with HWs, even if Ledger is not completely responsible of this, we are talking about a reseller which was authorized by them so they could distribute those wallets in all south Asia.

Ledger will definitely get sued because of this, let us see if victims get their money back from such lawsuit or not.

This only shows to what extent scammers and thieves are willing to go to get to steal one's stack...

[greysonz]

hmmm looks like trezor will be next.

I shifted some coins about we will see what is next to get stolen.

For some reason, the Ledger used these words in its latest report:

The company warns that the threat extends beyond Ledger to the broader hardware wallet industry and is calling for improved supply chain security standards.

https://x.com/Ledger/status/2109331538072494364

Although I think this statement is just Ledger's attempt to say that "this could happen to anyone", and is not based on any information.

Ledger also has resellers who, due to regional proximity, could also pose a threat due to potentially altered technical design.

Unfortunately, there is information that this incident has spread beyond Asia. Now Europe and South America too.

[Hamza2424]

Yes, it is official

This is the photo of the altered device from Mark Karpelès that he bought in Malasya

You can see there is an LTE module and an eSIM to communicate with the gang that did this and send all the seed details

Hmm, that's a surprising thing, bro. I don't know much about this, but what I found is very cool stuff to read. The nRF9151 chip used in the image you provided is an M2M SIM, and I just found that such eSIM providers won't even ask for KYC when providing them, and you can buy them in bulk. I thought these might be prepaid eSIMs, and I was thinking, how can someone manage them in bulk, even with stolen data? But these are not prepaid SIMs.

Also, these SIMs are capable of communicating globally, and any device we use can have one, and we won't even know it's there unless we check every device with detectors like the iProtect series. I have never used them, but I think we should use them if we have funds we can't afford to lose.

We can test whether our wallet is sending or receiving any spectrum using these tools. The iProtect series starts at around $500, and this alone is enough to find out if there is anything going out or coming in other than the specified signal.



Bro, at this point, we need to learn about these things and spend some extra bucks to secure what we have. Even if our portfolio is worth only $10k, we should get familiar with these gadgets. I am not advertising them, though.

[Richy_T]

The company warns that the threat extends beyond Ledger to the broader hardware wallet industry and is calling for improved supply chain security standards.

Not having dealings in countries where it's considered that if you're not cheating, you're not trying might be a start. Though in this case, it seems like it happened behind Ledger's back.

[Dogedegen]

Ledger is not responsible for this, and it can happen to any hardware wallet so please don't spread this kind of bad information.

I am not an anti fan of Ledger but let's say generic statement like if purchasing a device (whatever a device is) at an authorized store is still unsafe, that brand product is done.

Imagine that if I go to an authorized store of Apple, for example, and what I buy there is a fake iPhone, damn, I can not believe it and I don't mind what happened behind the scene, I will never use any Apple products later.

Apple or Ledger can blame on people who operate that authorized store but as customers of their products, my belief gone after that incident.

This is not a true comparison and your claim that the brand is done is false. Ledger has nothing to do with this case, they are not at fault at all. The reason for which they got targeted is because they have the most clients of all of those wallets that are being sold by the site. Even if Ledger completely removes all reseller programs so that you only can buy directly from them, that would not accomplish anything because you don't understand the attack vector. This is why people are blaming the wrong party here. Even if you order from Ledger directly, there can be a supply chain attack during the transit from ledger to you. This has happened by more organized agencies and hardware in the past, and it can happen again but by criminals. If it didn't happen yet that does not mean it is not possible or that removing resellers would solve anything. This type of attack that we have seen here is a first for crypto and hardware wallets too.

The only thing that could work is if the devices were completely tamper proof on a hardware level, but I don't know how that can be done.

Regardless or legal or ethical responsibility on Ledger side, it's enough to make more people skeptical or even distrust Ledger. People who do their research would aware this isn't first time 3rd party they use screwed up and harm Ledger customer in a way or another.

What is the proposed solution? Blaming the largest hardware provider for being the largest and best target for criminals doesn't make sense. Better due diligence with authorized resellers does not solve this attack.

For some reason, the Ledger used these words in its latest report:

The company warns that the threat extends beyond Ledger to the broader hardware wallet industry and is calling for improved supply chain security standards.

https://x.com/Ledger/status/2109331538072494364
Although I think this statement is just Ledger's attempt to say that "this could happen to anyone", and is not based on any information.

The statement is correct, even if someone does not like Ledger it does not make this false. The lesson from the coldcard incident was that very good passphrases must always be used with hardware wallets, and the lesson here is that supply chain attacks are a big vulnerability for hardware wallets.

[AakZaki]

You would be surprised. It doesn't look their growth[1] has been slowed down in anyway since the release of the recovery feature in 2023. Currently at 8 million units sold vs 2M+ from Trezor. Still don't understand why myself.

I think this is the reason why Ledger has much bigger sales than Trezor, the Ledger team is actively holding events or traveling the world to promote its big name.
But I think by now the name should have been worse than before.


If you pay attention to something that caught my attention, after about 24 hours of Ledger posting the announcement^[1] of the event, there was this bad news^[2] related to Ledger.
It seems to illustrate that this wallet drain incident is a form of prevention of the event that will be held by Ledger.

[1] - https://x.com/Ledger/status/2108170338492428613
[2] - https://x.com/SpecterAnalyst/status/2108534068564373687

[mikel_012]

Recent models like Ledger Stax are also among the affected

https://x.com/wentrre/status/2109339646102778306

LTE 4G modem, E-SIM and Antenna can be found in the board

[taufik123]

This reminds me of this:



God, do crypto nerds love fantasy stories on James Bond scenarios or Lupin the 3rd

So the evil guy will
- find your address from the ledger hack
- not knowing if you still have that, if it's in your home, if you actually have any coins on it
- he will stalk you, he will enter your house, he will magically find your hidden ledger between the 3rd and 4th brick in the kitchen wall, and then all his master plans described above

Or...
- He will find out where you live, enter during the night, beat the crap out of you till you hand him all your cash, all your jewelry, all your coins in every damn wallet you have

It was an old fantasy story but now the method has become more modern and we have never even realized it before.
These kinds of stories are actually an illustration or early warning of how hackers can create a new method inspired by stories like this and make the scenario more efficient with today's advanced tools.

Regardless or legal or ethical responsibility on Ledger side, it's enough to make more people skeptical or even distrust Ledger. People who do their research would aware this isn't first time 3rd party they use screwed up and harm Ledger customer in a way or another.

Even not only Ledger, now all hardware wallets are affected as well as the main focus of the ongoing hacking.
I was even skeptical of the Safepal hardware wallet that I had because the data leak also happened and even coincided with the leak of Ledger user data.

Furthermore, something like this can happen with any brand, be it Ledger, Trezor, or any other.
They'll say the problem is that Ledger had customer data leaked. Yes, but apparently it's happened to other brands too; there are also logistics companies that deliver the orders.

Finally, if we go down this path, I think the best solution starts with memorizing the seed. Only then can we avoid external factors. 

all affected and of course users will be more skeptical, this kind of scenario in the past was just a fantasy made for fun, but now it has become very real and can even take over millions of dollars in assets.

Uh, has there been any evidence that there are bands of people roving around, breaking into people's homes, searching carefully, potentially for hours through possibly many rooms for a device that may not even be present and then carefully swapping it out for an identical looking device and then carefully exiting, leaving no trace? This is nonsense.

I'm just visualizing the scenario written by Loycev, but if you ask if there is a group of people who wander around and break into people's homes to search for devices or hack into the network of home users, that's a real incident that has ever happened

As in the case of Marlon Ferro, also known as "GothFerrari", was found guilty of committing digital asset theft
and carrying out a series of fraudulent schemes combined with physical fraud by making scam calls to breaking into homes
from the database that was hacked to retrieve hardware wallets that contain Crypto assets such as BTC and others.

Source: https://www.justice.gov/usao-dc/pr/gothferrari-sentenced-78-months-prison-role-massive-cryptocurrency-heist

So the scenario is not a nonsense

Recent models like Ledger Stax are also among the affected

https://x.com/wentrre/status/2109339646102778306

LTE 4G modem, E-SIM and Antenna can be found in the board

The user who shares the inside of his device buys Ledger tax from Cryptobilis as well, so it is likely that all devices sold from Cryptobilis have been implanted


https://x.com/wentrre/status/2108852373921861720