Ledger said it has launched an investigation after customers reported lost funds and tampered devices, describing the case as one of the most sophisticated attacks the digital asset industry has seen.
Ledger says attackers bought devices, implanted hardware, and returned them to the market
In a statement released Thursday, the hardware wallet maker said a "highly organized criminal group" purchased Ledger devices, installed implants that could read users’ seed phrases, and then placed the wallets back into the supply chain through resellers.
The Paris-based company had said last week that it began investigating after customers in Southeast Asia reported losing funds after buying devices from Malaysia-based reseller CryptoBilis. Ledger later said it confirmed that one impacted user’s device contained an unauthorized hardware implant.
Losses remain unclear, while Specter puts drained funds at $86 million
Ledger did not say how much money was lost through the tampered devices. Blockchain investigator Specter said $86 million had been drained.
Ledger did not respond to written questions from Bitcoin Magazine.
In its Thursday statement, Ledger said: "[The criminal group] built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets."
Company says its chip, operating system, and servers were not compromised
Ledger said there was no flaw in its chip, operating system, or servers, adding that its systems were not compromised. The company said the incident was an attack on the distribution channel after the devices left Ledger’s control.
Ledger also said that in what it called its largest investigation to date, it sent employees to other markets, including Europe, to determine whether other supply chains had also been targeted. The company said screened devices were clean, and that authorized resellers and distributors in Southeast Asia and Hong Kong have suspended sales.
Ledger added that it is working with law enforcement to "follow the funds and dismantle the attackers’ infrastructure." Its statement did not make clear how many customers were targeted.
Hardware wallet security incidents remain in focus
The crypto industry is still dealing with the fallout from a July incident in which hackers stole close to $120 million in bitcoin from Coldcard users.
There have also been multiple data breaches this year. Scammers targeted Ledger through its payment processor Global-e in an effort to obtain customer information.
The report first appeared in Bitcoin Magazine and was written by Mathew Di Salvo.