A large-scale cyberattack against cryptocurrency owners has revealed a serious breach in the hardware wallet supply chain. Through physically modified devices from the popular Ledger brand, cybercriminals have already managed to steal over 85 million euros, with the damage caused continuing to grow. The victims are mainly users who purchased their equipment from third parties and unofficial retail chains. The French manufacturer categorically emphasizes that devices ordered directly from their official website are fully protected and have not been subject to manipulation.
The scheme for committing the theft relies on extremely precise engineering intervention in the hardware. Inside the wallet, directly under the display module, the attackers integrate a special flexible board equipped with an eSIM and an LTE transmitter. At the time of initial setup, when the device generates and displays the secret private key or so-called seed phrase on the display, the board reads the pixels from the image. The data is instantly transmitted to the criminals' servers via the mobile network, giving them full access to the victim's future assets.
The first compromised units were detected at the Asian distributor Cryptobilis, which sold affected devices in Malaysia, Indonesia and the Philippines, including through the Amazon Japan platform. As a result of the revelations, the retailer suspended sales of all brands of hardware wallets, including Trezor, Coolwallet and Tangem, although at the moment there is no evidence of such interventions with them. However, the investigation quickly established that the problem is not limited to Asia. Modified wallets were also found in the MediaMarkt retail network in Europe, delivered through the European distributor Aqipa GmbH, which indicates a significantly wider geographical scope.
The technological analysis shows a worrying evolution in the criminal group's actions. While the modifications initially discovered were made in an artisanal manner, the latest intercepted units contain industrially produced components. This indicates the existence of an organized production line for mass re-equipment of original Ledger devices before they reach end customers.
Ledger has sent urgent instructions to all users who purchased devices from unofficial retailers in the last three months. Those who have not yet configured their wallet are advised to immediately stop the process. Users who have already gone through the setup process should transfer their funds to a new wallet with a completely new recovery phrase as soon as possible. To ensure safety, the company publishes detailed technical diagrams for visual inspection of the physical integrity of each model and reminds that the control software should only be downloaded from their official Internet portal.