Hardware wallets are widely used for the self-custody of digital assets, but a recent supply-chain incident shows that even devices purchased through an authorised reseller may face physical tampering risks before reaching customers.
On October 9, 2026, users who had purchased Ledger hardware wallets through Southeast Asian reseller CryptoBilis reported that their assets had been stolen. Ledger subsequently confirmed that at least one affected device contained an unauthorised hardware implant and said it was investigating the incident. Blockchain analytics firms traced related fund movements and estimated losses exceeding $90 million, although their figures differed in scope and Ledger had not confirmed a final loss total. Tether also froze approximately $10 million in USDT linked to the theft.
The incident highlights a broader security lesson for digital asset holders and service providers: wallet security depends not only on cryptographic design and software protections, but also on manufacturing, distribution, device handling and the initial setup process.
How Did the Hardware Wallet Supply-Chain Attack Work?
According to Ledger's investigation updates and related security reporting, an affected device contained an unauthorised hardware component. The implant could reportedly read the recovery phrase displayed during device setup and transmit the information through a mobile network. Once attackers obtained a recovery phrase, they could restore the wallet on another device and transfer the assets.
This differs from common software vulnerabilities and phishing attacks. A user may receive a genuine branded product and follow what appears to be a normal setup process, yet still face a risk if the device itself has been physically modified. Even when a wallet's secure element and official software remain uncompromised, an additional component may expose sensitive information outside the intended security architecture.
Ledger stated that, at the time of its disclosed investigation updates, all confirmed cases involved devices sold through CryptoBilis. The company said its own systems and direct sales channels remained unaffected. It advised customers who had purchased from the reseller not to initialise unused devices. Users who had already used an affected device were advised to move their assets to a new device with a newly generated recovery phrase.
Loss estimates from blockchain analysts should not be treated as a final figure confirmed by the manufacturer. The number of affected wallets, total value lost and full attack chain remain subject to further investigation.
Why Are Brand Reputation and Chip Verification Not Enough?
Hardware wallet security typically relies on secure elements, firmware verification, recovery phrase protection and transaction-signing controls. A supply-chain attack can undermine familiar checks: a device may look authentic and carry the expected branding while containing an additional component that was installed before delivery.
Businesses purchasing hardware wallets should therefore incorporate supplier management and delivery inspection into their security procedures. Procurement teams should verify authorised distribution channels, supplier status, device identifiers and packaging integrity. They should also maintain traceable records connecting each device to its supplier and assigned user. High-value asset operations may require dual-person acceptance, isolation of suspicious devices and independent security checks.
Individual users should avoid devices from unknown sources, informal resale channels or packaging that appears altered. Recovery phrases should only be handled through a trusted setup process and must never be entered into websites, messaging applications or forms provided by purported support staff. Any request to disclose a recovery phrase for verification, upgrades or asset protection should be treated as a serious warning sign.
For institutions, hardware security should be combined with access management. Permissions should reflect employees' responsibilities, high-value transactions may require multiple approvals, and wallet devices, key backups and recovery procedures should be reviewed regularly. These controls can reduce the potential impact of a compromised device or supplier.
How Can KYT Help Trace Stolen Crypto Assets?
After a theft, on-chain tracing can help investigators understand how attackers move and split the stolen funds. Know Your Transaction (KYT) systems and blockchain analytics tools can analyse transaction paths, consolidation wallets, cross-chain movements and addresses associated with known high-risk entities.
In this incident, analytics firms traced movements across multiple blockchains. Some funds moved as stablecoins such as USDT, whose issuers may be able to freeze tokens at specific addresses where permitted by applicable law and policy. Tether’s freeze of approximately $10 million in related USDT illustrates this capability in certain circumstances. However, the frozen amount should not be interpreted as the total loss recovered, and other crypto-assets cannot necessarily be frozen in the same way.
Businesses should maintain an incident-response process for collecting transaction hashes, affected addresses, timelines and asset information. They should promptly contact relevant exchanges and service providers and share appropriate information with law enforcement through lawful channels. KYT alerts can help identify suspicious flows, but blockchain addresses do not directly reveal real-world identities. Findings must be assessed alongside other evidence.
The incident demonstrates that digital asset security requires coordinated controls across device supply chains, private key management, access permissions and blockchain monitoring. For individuals, trusted sourcing and a newly generated recovery phrase are essential. For exchanges and compliance teams, rapid tracing, evidence preservation and cooperation with relevant institutions can help improve response times and limit further losses.