Behind the evaporation of 86 million dollars: The Ledger supply chain heist and the weakest link of hardware wallets

Author: Gu Yu, ChainCatcher

A person transferred 80 Bitcoins into a newly purchased Ledger. The device was bought from an official authorized dealer, and the mnemonic phrase was handwritten and locked in a safe. This batch of coins was credited on September 29, with a purchase cost of about 5.2 million dollars, and at one point had an unrealized profit of 1.38 million dollars. On October 9 at 05:54 (UTC), all 80 BTC were transferred in a single transaction.

He did everything the textbook required.

On the same morning, similar reports began to appear in large numbers on X and Reddit: a user’s Ledger Stax was transferred with nearly 100,000 USDT, and the mnemonic phrase was also handwritten and locked in a safe. The only commonality among these users was that the devices were all purchased from the Southeast Asian dealer CryptoBilis.

On October 9 at 13:32 (UTC), Ledger confirmed that it was investigating and requested CryptoBilis to suspend all sales and shipments of Ledger devices; users who purchased devices from this channel within the last 90 days should not initialize them if they have not been initialized yet, and those that have been initialized should immediately transfer their assets to a new device generated with a new mnemonic phrase.

I. The scale of losses may exceed 90 million dollars

How large the losses are, can only be estimated on-chain at the moment.

On-chain investigator Specter first published ten aggregation addresses at 12:24, covering Bitcoin, Ethereum, and Tron, estimating losses exceeding 86 million dollars; another investigator, tanuki42, listed eight of those addresses, giving an estimate of over 72 million dollars; SlowMist's MistTrack stated that the figure "is approaching 90 million dollars"; Bitquery covered 311 wallets, estimating about 92.9 million dollars, with approximately 42 million in Ethereum, about 17.6 million in Bitcoin, and about 16.5 million in USDT. Arkham has labeled these addresses as "Ledger Theft," and as of Friday afternoon, approximately 71.5 million dollars remained in the marked addresses, with the largest positions including about 29.4 million dollars in ETH, 17.5 million dollars in BTC, 13.6 million dollars in USDD, and 10.8 million dollars in USDT.

More noteworthy than the total amount is the profile of the victims. Lookonchain detected that a certain address deposited 7 million USDT three weeks after purchasing the device, which was completely transferred out about ten hours before the report, possibly the largest single transaction; three other marked Bitcoin addresses held approximately 211 BTC at 13:44 (UTC), with no transfers out at that time. According to Chain INK, this incident involved about 98 wallets, averaging about 890,000 dollars each.

This is not a case of retail investors losing a few hundred dollars. This is the kind of wallet where someone has put in their savings.

Comparing it with another incident this year, the difference in distribution speaks more than the total amount. In July, Coldcard suffered a loss of about 111 million dollars due to a firmware random number defect that allowed the mnemonic phrase to be inferred, but it was spread across more than 5,200 wallets, averaging about 21,000 dollars each; whereas this CryptoBilis incident, which reached second place in less than a day (about 87 million dollars), only involved about 98 wallets, averaging close to 890,000 dollars.

Coldcard's incident was a wide net, while this one is a precise harvest. This distribution itself supports the inference of "implanted modules": the attacker has control over the mnemonic phrases generated on each modified device, allowing them to wait—wait until the money comes in before acting, specifically targeting those worth attacking. The 80 BTC monitored by Lookonchain were quietly lying in the device for ten days before being transferred all at once.

II. After opening the device: the microcontroller on the screen ribbon

Ledger has not explained the attack mechanism, but someone has already opened the device.

The most specific description comes from former Mt.Gox CEO Mark Karpelès. He stated that one device he received came from Malaysia—listed at half price on Amazon, shipped from Malaysia rather than Japan where he ordered it, which itself was the first warning sign. After opening it, he found a hidden module where the screen padding should have been: a single-strand wire of an antenna, space freed up by a shortened battery or removed screen padding, an LTE module with eSIM, and a microcontroller connected to the device's SPI bus.

His judgment is that this microcontroller can recognize the font used by Ledger on the 128×64 screen, lock onto the mnemonic phrase setup interface, and send the mnemonic phrase displayed character by character as the user writes it down via LTE.

SlowMist's Chief Information Security Officer 23pds provided the corresponding technical path: the attacker installed a microcontroller inside the device, connecting to the screen's SPI data line; after the mnemonic phrase is generated inside the secure element, it is displayed on the screen for the user to write down, while the malicious module synchronously records every character output on the screen, then transmits it via the built-in LTE or eSIM. He emphasized that the role of the secure element is to prevent the private key from being directly read or exported, but it cannot control what is being displayed on the screen—the few seconds when the mnemonic phrase appears on the screen is the attack window.

This explains the most counterintuitive aspect of the entire incident: these devices can pass Ledger's authenticity verification. Because the secure element is real, it does correctly generate the mnemonic phrase and does sign normally; it is just being "watched." The firmware also cannot detect it because the implanted module only listens during screen refreshes. In other words, the only detection method is—opening the device.

Two other possibilities also exist: one is pre-set mnemonic phrases—attackers power on, set up, record, and repackage in advance, leading users to believe they are "setting up a new device," while in fact, they are using a set of words already mastered by the attacker; the second is phishing. Developer 0xQuit believes that some victims may have fallen victim to phishing, stating that it is irresponsible to simply say "Ledger was hacked."

III. "Official authorization" endorses sales qualifications, not supply chain integrity

CryptoBilis is not a street vendor.

It was established in Kuala Lumpur in 2020 and is listed in black and white on Ledger's official dealer page as an official authorized dealer, covering Malaysia, Indonesia, and the Philippines, selling not only Ledger but also Trezor, OneKey, Tangem, and SafePal.

The problem lies precisely here. Users follow the security guidelines taught by the industry: if they cannot buy directly from the official website, they look for "official authorized dealers." But the authorization endorses this company's sales qualifications, not the integrity of every device in its warehouse, nor the integrity of every employee handling and sorting. Once a device leaves the factory, goes through logistics, passes through warehouses, is sorted, reaches the dealer, and is delivered to the door, any link in this chain could be intercepted, opened, and restored—the heat shrink film on Karpelès's device was intact.

Once the device leaves Ledger's custody, the word "authorized" no longer provides any physical guarantee.

Even more subtle is the timeline. Newly disclosed company records show that CryptoBilis was acquired in March of this year, and a person named "Jia Ming," registered in Heilongjiang Province, China, has held 100% of the company's shares since August 3. The former co-founder confirmed the acquisition in March, stating that the original shareholders subsequently withdrew from all operational, management, and administrative positions, and after the handover, they could no longer understand the company's actual operations, urging the current management to handle matters transparently. According to Deep Tide TechFlow, the acquirer signed a confidentiality agreement with former executives that restricts them from disclosing transaction details, effective until October 19—when the incident broke out on October 9, former executives were still legally unable to freely discuss the acquisition details.

Currently, there is no conclusive evidence to suggest that the change in ownership is related to the device theft, and Ledger has only halted sales without making any accusations.

On October 10, CryptoBilis announced the suspension of sales and shipments of all brand hardware wallets through its stores and online channels in Malaysia, the Philippines, and Indonesia, reminding users: the mnemonic phrase must be generated by the device during initialization and handwritten by the user; if the device comes with a pre-printed or written mnemonic card, it should be considered unsafe.

CryptoBilis is not the only channel to have issues this year. In September, Trezor admitted that its logistics contractor ShipMonk was hacked, resulting in the leakage of real names, phone numbers, and home addresses of about 81,000 American customers; in January of this year, Ledger disclosed that payment processor Global-e leaked the names and contact information of some official website buyers. These incidents did not directly result in lost coins, but they repeatedly handed over the list of "who received a hardware wallet and when" to attackers.

In the past three months, the weakest link in cold storage has shifted from code to logistics.

IV. Recovery, self-rescue, and the cheapest advice

The window for recovery is closing.

According to MistTrack, Tether has frozen a large amount of USDT at the relevant addresses; the attackers immediately began converting USDT into USDD—a Tron stablecoin that Tether cannot freeze. According to Onchain Lens, 430.2 ETH (about 1.07 million dollars) has already entered Tornado Cash through four wallets. Bitcoin and Ethereum do not have freeze switches; once the money leaves, only exchanges remain as a barrier.

SlowMist and Security Alliance have opened a help channel, with the latter urging users whose funds were transferred to relevant addresses to contact their SEAL 911 emergency response team.

Among the advice given by the industry, the most practical one comes from CZ. While assessing this as "a supply chain attack limited to a specific dealer," he provided a specific actionable plan:

"After buying a hardware wallet (or downloading a new software wallet), keep it for a few weeks before transferring any meaningful amount into it. During these weeks, continuously monitor relevant news… The hardware may have been modified, and the software's official website may also have been attacked. Self-custody means additional responsibility."

The logic behind this "quarantine period" is not technical but informational: if a batch of devices has already been tampered with when delivered to the dealer, on-chain analysts need time to discover the first batch of stolen devices and issue alerts—these two weeks are the time you buy for yourself.

But what this incident truly rewrites is the boundary of the term "self-custody."

For the past decade, the industry has built the narrative of self-custody security almost entirely on cryptography and hardware: secure elements, EAL5+, PIN erasure, open-source audits. None of these have been breached. What has been breached is the segment of the journey from the factory to your doorstep—a segment composed of logistics providers, warehouses, dealers, and couriers, where no link can be verified by the user.

Hardware wallets promise that "private keys never leave the device." The irony this time is that the private keys indeed never left the device—they were just seen by someone else during those few seconds when they were displayed to the user.

And when the security boundary extends from the chip to the delivery at your doorstep, the last line of defense that users can really take may just be: Don't rush to put your money in.