A reported $90 million cryptocurrency theft is forcing the industry to reconsider one of its most trusted security assumptions: that keeping private keys away from the internet is enough to keep digital assets safe.
According to reporting from the Financial Times and industry observers, criminals allegedly modified genuine Ledger hardware wallets before they reached customers. Hidden components inside USB-like devices reportedly captured users’ recovery phrases during setup and transmitted the information through cellular connectivity. Estimates vary, with losses reported at roughly $90 million to more than $93 million across over 300 wallets. Ledger has not independently confirmed the final amount. [2][7][15]
The incident is significant because it was not described as a conventional software hack. Instead, it appears to have exploited the supply chain surrounding physical security products—a reminder that every layer between manufacturer and customer can affect the safety of a crypto wallet.
WHAT reportedly happened
Hardware wallets are designed to protect cryptocurrency by isolating private keys from ordinary computers and internet-connected applications. During setup, the device generates or displays a recovery phrase, usually consisting of 12 or 24 words. This phrase acts as a master backup: anyone who obtains it can typically restore the wallet on another compatible device and transfer the assets.
In the reported attack, criminals allegedly purchased authentic Ledger devices, opened them, installed covert password-reading components, and returned the products to distribution. The compromised devices were reportedly sold through CryptoBilis, a Southeast Asian reseller. Investigators said the hidden implants could read the recovery phrase displayed during initialization and send the information using LTE or eSIM technology, bypassing the customer’s computer and Wi-Fi network. [2][5]
That distinction matters. The reports indicate that the Ledger secure element and transaction-signing process were not necessarily compromised. The attack targeted the moment when users first created or entered their recovery information. Once the attackers had the phrase, they did not need to defeat the wallet’s encryption or intercept every transaction. They could simply reconstruct the wallet elsewhere and move the funds.
Why Cold Storage Is Not A Complete Security Strategy
Cold storage remains an important risk-management tool. A properly used hardware wallet can substantially reduce exposure to malware, phishing sites, exchange failures, and online account takeovers. However, “offline” does not mean “immune to tampering.”
A hardware wallet is part of a broader system that includes manufacturing, packaging, shipping, retail distribution, device initialization, firmware verification, and user behavior. A weakness in any of those stages can undermine the security benefit of the device itself.
This is a classic supply-chain attack. Rather than attacking thousands of customers individually, criminals allegedly altered products upstream and allowed the devices to reach users through a legitimate sales channel. That approach can be difficult for buyers to detect, particularly when packaging appears authentic and the wallet functions normally.
The reported case also highlights a crucial principle: the recovery phrase is more valuable than the device. Users often focus on keeping the wallet in a safe place while overlooking the phrase’s exposure during setup, backup, or recovery. Anyone who sees, photographs, records, or electronically captures those words may be able to control the funds permanently.
What Users Should Do Now
Customers who purchased a Ledger device through the reported reseller should avoid initializing it until they confirm its provenance and security status. Reports said CryptoBilis paused sales and shipments, while Ledger advised customers in affected markets to take specific precautions. Buyers should consult official Ledger communications directly rather than relying on social-media instructions or unsolicited support messages. [2][6]
Users should also consider these practical safeguards:
Never enter a recovery phrase into a phone, computer, website, form, or messaging application.
Write the phrase by hand and store it offline in a secure location. Never photograph or digitally scan it.
Buy hardware wallets directly from the manufacturer or an authorized seller, and inspect packaging, seals, device condition, and verification procedures.
Complete the manufacturer’s authenticity and firmware checks before creating a wallet.
For significant balances, consider using a multi-signature arrangement that requires multiple independently secured approvals.
Test recovery procedures with a small amount before transferring substantial funds.
If a recovery phrase may have been exposed, treat the wallet as compromised. Move assets to a newly generated wallet using a trusted, verified device, and never reuse the old phrase.
These steps cannot eliminate every risk, but they reduce the damage a single compromised device or account can cause.
Market And Industry Implications
The immediate market effect may be more pronounced in crypto security sentiment than in broad asset prices. A theft of approximately $90 million is material, but it is small compared with the total cryptocurrency market capitalization and does not automatically imply that Ledger’s software or every hardware wallet is unsafe.
The incident could nevertheless weigh temporarily on confidence in self-custody providers, especially among newer users who view hardware wallets as a simple, definitive answer to security concerns. It may also increase demand for stronger tamper detection, verified distribution channels, transparent device attestation, and multi-signature custody.
For manufacturers, the lesson is that secure chips and audited code are not sufficient on their own. Physical inspection, reseller oversight, anti-tampering design, secure logistics, and customer education must be treated as part of the security model.
For traders, the event is also a reminder to separate headline risk from systemic risk. A specific supply-chain compromise does not prove that every self-custody product is compromised, but it does show why diversification of custody and careful operational procedures matter.
The Bigger Lesson For Simulated And Real Markets
Security incidents often create a gap between technical reality and market perception. Traders may react quickly to a headline, while the full investigation takes weeks or months. In a SimFi environment, this makes the event useful for studying how a single incident can affect sentiment, implied risk, volatility, and the valuation of companies connected to digital-asset infrastructure.
The most important conclusion is not that hardware wallets have failed. It is that security is a process rather than a product. Investors must evaluate where a device came from, how it was initialized, how its recovery phrase is stored, and what safeguards exist if one layer is breached.
A hardware wallet can reduce online attack risk, but it cannot replace verification, disciplined custody, and informed decision-making. The reported theft demonstrates that in crypto, the safest strategy is rarely a single tool. It is a carefully designed system with multiple independent defenses.