A reported $90 million cryptocurrency theft is putting renewed attention on one of digital assets’ most important promises: self-custody. The incident reportedly involved genuine Ledger hardware wallets that had been opened, modified with concealed components and returned to the supply chain. Attackers allegedly used the devices to capture users’ recovery phrases during initial setup, allowing them to restore and drain the associated wallets. [9]
The reported losses have been estimated at roughly $90 million, although the final figure and number of affected users remain under investigation. Blockchain researchers have linked the stolen funds to hundreds of wallet addresses, while Ledger has said the incident was a physical supply-chain attack rather than a compromise of its software or internal systems. [8]
For crypto markets, the event matters beyond the immediate dollar value. It challenges assumptions about hardware wallets, highlights the risks of unofficial distribution channels and could weigh on sentiment toward companies involved in crypto custody, security and digital-asset infrastructure.
How The Attack Reportedly Worked
Hardware wallets are designed to keep private keys isolated from internet-connected devices. During setup, a user typically generates or enters a recovery phrase, often consisting of 12 or 24 words. That phrase is the master backup for the wallet. Anyone who obtains it can generally recreate the wallet elsewhere and move its assets.
According to reports, criminals acquired authentic devices, modified them and concealed password-reading hardware inside. The added components allegedly monitored information sent to the device’s display during setup. Some investigations have suggested that the implants included communications hardware capable of transmitting the captured recovery phrase to attackers over a mobile network. [4]
This distinction is important. The reported attackers did not necessarily break Ledger’s core cryptographic protections or remotely hack the company’s servers. Instead, they targeted the physical device before it reached the customer. In effect, the security failure occurred in the supply chain and during the initial trust-building process.
Ledger has described the incident as one of the most sophisticated attacks observed in the industry. Reports have connected confirmed cases to devices sold through CryptoBilis, a Southeast Asian reseller. Ledger has urged customers who purchased devices through the affected channel to follow its guidance and avoid initializing potentially compromised hardware. [3]
Why Hardware Wallets Are Not Automatically Risk-free
Hardware wallets remain an important security tool, but “cold storage” is not the same as absolute security. A wallet can protect private keys from malware on a computer while still being exposed to tampering, counterfeit products, compromised accessories or unsafe setup procedures.
The incident illustrates a broader security principle: the strongest technology can be undermined by a weak point elsewhere in the process. A secure chip does not protect a recovery phrase if a malicious component can observe it before the wallet completes setup. Similarly, a genuine product may not be safe if it was opened, altered or stored improperly before reaching the buyer.
Users should also remember that recovery phrases should never be typed into websites, entered into mobile applications or photographed. They should be generated and recorded according to the manufacturer’s official instructions, then stored offline in a secure location. A wallet provider should never ask for the phrase through email, direct message or customer support.
Practical Steps For Wallet Users
Anyone who recently purchased a hardware wallet should verify the seller, purchase channel and device packaging. Avoid devices bought from unknown marketplaces, private sellers or unverified resellers, particularly when the price is far below normal retail levels.
Customers should compare the device and packaging with the manufacturer’s official verification guidance. They should also inspect for unusual gaps, scratches, inconsistent seals, unexpected accessories or signs that the unit has been opened. Physical inspection can help, but it is not a complete guarantee; sophisticated tampering may not be visible without specialist analysis.
If a device came from a reseller connected to the investigation, users should not initialize it or transfer funds to it until they have checked current guidance from Ledger. Anyone who has already used a potentially affected wallet should treat its recovery phrase as exposed. The safest response is generally to create a new wallet using trusted, verified hardware and move assets to the new addresses. The old recovery phrase should not be reused.
Large balances should also be divided across wallets where practical. A separate wallet for everyday transactions can reduce exposure, while long-term holdings can remain in a more restricted account. Multisignature arrangements may provide an additional layer of protection for organizations, funds and high-net-worth users by requiring multiple approvals before a transaction is signed.
What This Means For The Simfi And Crypto Industry
The reported attack could influence how traders evaluate custody businesses and hardware-wallet manufacturers. Investors may focus more closely on reseller oversight, device-authentication systems, tamper-evident design, secure logistics and the speed of incident response.
For SimFi participants, the event is also a useful risk-management lesson. Simulated trading environments can help traders test strategies without exposing real capital, but real-world digital-asset operations still require operational controls. Position sizing, withdrawal procedures, account permissions and authentication practices can matter as much as market analysis.
Market sentiment may remain sensitive to further reports about the total losses, the number of affected devices and whether investigators identify additional distribution channels. The immediate theft is significant, but its long-term impact will depend on whether the industry can demonstrate that supply-chain controls and customer verification processes are improving.
The Bigger Lesson
Self-custody removes certain counterparty risks, but it transfers responsibility to the user and the surrounding supply chain. Security depends not only on cryptography, but also on where a device was purchased, how it was handled, how the recovery phrase was created and how transactions are approved.
The reported $90 million attack is a reminder to treat every hardware wallet as part of a broader security system rather than as a magic shield. Verify the source, protect the recovery phrase, separate trading funds from long-term holdings and respond quickly whenever a device’s integrity is uncertain. In crypto, convenience can be valuable, but verification is what turns security features into actual protection.