A reported crypto wallet-security attack has exposed a painful contradiction at the heart of digital-asset investing: hardware wallets can remove many online threats, but they cannot automatically protect users from compromised devices, distribution channels, or human error. Investigators estimate that roughly $90 million in cryptocurrency may have been stolen from users who purchased tampered Ledger wallets, making the incident one of the most serious physical supply-chain attacks in the sector. [3][4]
The estimated losses remain subject to change. Ledger has not confirmed the total number of affected users or the final value of stolen assets, while independent blockchain researchers have produced estimates ranging from more than $86 million to over $100 million. [1][15] Even so, the incident is significant because it targeted the security process surrounding a hardware wallet rather than relying on a conventional exchange breach or software exploit.
How The Attack Reportedly Worked
According to reporting on Ledger’s investigation, criminals obtained genuine Ledger devices, physically opened them, and installed concealed components before the wallets reached customers through resellers. Devices connected to Southeast Asian distributor CryptoBilis have been repeatedly associated with reported losses. Ledger has said that the compromised products were altered after leaving its direct control and that the company’s internal systems were not breached. [2][7]
The reported implants were designed to observe the recovery phrase displayed during the device’s initial setup. A recovery phrase, usually consisting of 24 words, is the master credential for a crypto wallet. Anyone who obtains it can often restore the wallet on another device and transfer its assets.
The sophistication of the alleged attack came from its ability to bypass the customer’s computer and Wi-Fi connection. Investigators reported that the implanted hardware used LTE connectivity and an embedded eSIM to transmit captured information through a mobile network. [2][12] This meant that users could be operating a seemingly authentic wallet on a clean computer while their recovery phrase was secretly being sent to attackers.
Why Hardware Wallets Are Not Invulnerable
Hardware wallets are generally designed to keep private keys isolated from internet-connected devices. They can reduce exposure to malware, phishing sites, exchange failures, and compromised personal computers. However, the Ledger incident demonstrates that “offline” security is not the same as complete security.
The device must still be manufactured, shipped, sold, opened, initialized, and used. Each stage creates a possible attack surface. If a wallet is physically modified before it reaches a customer, the security assumptions behind the product can be undermined before the user ever connects it.
The event also highlights the importance of the recovery phrase itself. Many users treat the hardware wallet as the source of security, but the phrase is the critical asset. It should never be photographed, typed into a phone, stored in cloud notes, or entered into a website. A compromised device that exposes the phrase can give attackers permanent access, even if the wallet later appears to function normally.
What Users Should Do Now
Anyone who purchased a Ledger device through a reseller linked to the investigation should avoid initializing an unused wallet until the seller and Ledger provide clear guidance. Ledger has advised customers with suspected CryptoBilis devices not to initialize them, while users who already initialized affected devices have been told to move assets to a new device using a freshly generated recovery phrase. [2]
That process should be approached carefully. Users should acquire the replacement wallet from a trusted, verified channel, inspect the packaging and device for signs of tampering, and generate the new recovery phrase directly on the replacement device. Funds should be transferred in stages, beginning with a small test transaction.
Users should also review wallet activity on a blockchain explorer. Unexpected approvals, unfamiliar transfers, or new addresses receiving funds may indicate compromise. Stablecoins deserve particular attention because issuers can sometimes freeze assets associated with identified thefts. Reports indicated that Tether froze USDT linked to the incident, although freezing cannot recover every stolen asset or protect assets that have already moved through multiple addresses. [4]
The safest response to a suspected compromised recovery phrase is to treat it as permanently exposed. Moving funds back to the original wallet, even after resetting or updating software, does not solve the underlying problem.
What The Incident Means For The Market
The direct financial loss is meaningful, but the broader impact may be confidence. Crypto markets already face volatility from macroeconomic policy, liquidity conditions, regulation, and leveraged positioning. A high-profile attack involving a respected hardware-wallet brand adds a different kind of risk: uncertainty about custody infrastructure.
The incident is unlikely by itself to determine the long-term direction of Bitcoin or the wider market. It does, however, reinforce the need for investors and trading firms to distinguish market risk from operational risk. A profitable strategy can still fail if access credentials are stolen, withdrawal procedures are poorly controlled, or assets are concentrated in one wallet.
For professional traders, the lesson is to use layered controls. Separate long-term holdings from active trading funds, establish transaction limits, require multiple approvals for large transfers, and maintain secure backups of recovery information. For individuals, the most important improvement may be simple: buy devices from verified sources and assume that a recovery phrase is equivalent to total account access.
A New Standard For Wallet Security
The reported $90 million theft shows that crypto security is not merely a software problem. Manufacturers, distributors, resellers, and users all form part of the custody chain. Strong encryption and secure elements remain valuable, but they must be supported by tamper detection, authenticated distribution, transparent incident response, and practical user education.
For investors, the central takeaway is straightforward: a hardware wallet can reduce risk, but it cannot eliminate it. Security depends on the integrity of the entire process—from production and delivery to setup and daily use. As digital assets become more valuable, protecting the device and protecting the recovery phrase must be treated as equally important responsibilities.