Ledger, a manufacturer of hardware cryptocurrency wallets,
is investigating an attack involving modified devices that contain hidden tracking components. The estimated losses exceed $90 million.
At the center of the investigation is the Malaysian cryptocurrency retailer CryptoBilis, whose customers began reporting missing funds on October 9. Blockchain researchers estimate that over $90 million worth of digital assets has been stolen.
Paris-based Ledger stated that an organized criminal group installed covert hardware components into some of its wallets.
The company is also examining reports of compromised devices purchased elsewhere, raising concerns that the attack may extend beyond CryptoBilis.
CryptoBilis has temporarily closed its physical stores in Kuala Lumpur. Ledger stated that it is cooperating with local law enforcement, while the retailer itself has declined to comment.
Independent security experts believe the modified devices contain components capable of intercepting sensitive information displayed on the wallets' screens and transmitting it to attackers via cellular networks.
Such modifications could allow criminals to gain access to cryptocurrency assets without needing to breach the devices' core security chips.
This incident highlights supply chain security challenges in the cryptocurrency storage sector, particularly when devices pass through third-party distributors or resale channels.
Ledger’s investigation comes amid a series of other security-related incidents involving hardware wallet manufacturers.
Earlier this year, a software vulnerability in devices produced by Coinkite reportedly led to the loss of approximately $130 million in Bitcoin. Separately, a data breach occurred via a delivery service used by Trezor, exposing the personal information of approximately 67,000 customers.
The investigation also uncovered evidence of tampered devices outside of Malaysia.
An examination of a Ledger Flex device, purchased at Singapore’s Changi Airport, allegedly revealed a modified display connector, a cellular chip, and a SIM card.
These findings raise questions about how compromised devices entered retail distribution channels and whether other customers remain at risk.
Ledger has not yet determined the full scope of the attack or disclosed how many devices may have been affected.