Author: Nancy, PANews
The mnemonic phrase was not leaked, nor had there been any interaction with external devices, yet the assets in the hardware wallet were transferred away overnight. On October 9, an asset theft incident involving more than $93 million thrust the veteran hardware wallet Ledger into the spotlight.
As the incident continued to escalate, from a third-party reseller being revealed to have quietly changed ownership to the device allegedly containing an implanted spy module, multiple clues sparked speculation about the attack path, but the specific cause of the incident remains unidentified. This security storm not only left Ledger facing a trust crisis, but also once again pushed the security of hardware wallets into the focus of public opinion.
Over $93 Million Stolen, Attacker Laid the Groundwork Weeks in Advance
On October 9, Ledger users on X and Reddit successively claimed that their wallets had been stolen. Many users said that their mnemonic phrases had always been written down and properly kept, and that their hardware wallets had barely interacted with external devices, yet their assets were still emptied. Some users also said that their wallets showed unlimited approval signatures they were unaware of. These abnormal signs quickly drew attention to this security incident.
According to information disclosed by the victims, the industry generally attributed this Ledger theft incident to a supply chain attack. Multiple users said they had purchased Ledger devices through the third-party reseller CryptoBilis, and some of the devices had been purchased and activated not long ago.
Subsequently, Ledger also pointed the focus of its investigation at the reseller CryptoBilis in its response. The company said it was investigating the theft of user funds from devices purchased from CryptoBilis in Southeast Asia, and had asked the reseller to suspend all sales and shipments of Ledger devices. At the same time, Ledger advised users who had purchased devices from this reseller within the past 90 days that if they had not yet initialized the device, they should not set it up; if they had already completed setup, they should transfer assets to a new device initialized with a brand-new mnemonic phrase.
According to tracking by on-chain data analysis platform YFarmX, the attacker transferred approximately $93.4 million from 471 addresses across 7 blockchains, with the vast majority of losses occurring on October 9. At present, the attacker has transferred more than $3 million worth of ETH into the mixing service Tornado Cash. Meanwhile, Tether has frozen $10 million worth of USDT in the thief's wallets. However, another $14.6 million in funds is held in the form of USDD and cannot be frozen through Tether.
In terms of asset distribution, Tron was the hardest-hit area in this incident, with losses mainly concentrated in USDT, amounting to approximately $69.98 million. Among them, a single Tron address lost as much as 7.001 million USDT. Losses on the Bitcoin network reached $17.59 million, with more than 90% of the stolen BTC coming from addresses that had first received funds less than 90 days earlier. One of the most severely affected Bitcoin wallets had all its assets transferred away just one week after receiving 80 BTC.
It is worth noting that the affected wallets were not all new devices. According to YFarmX analysis, the emptied addresses spanned a wide range of usage durations, including wallets created only a few days earlier as well as wallets that had existed for more than five years. This means the scope of impact may not be limited to recently purchased or activated devices. On-chain tracking shows that the asset transfers from these addresses were all completed through valid signatures or previously granted approval permissions.
Even more alarming is that the attacker appeared to have made full preparations for this operation long in advance. The relevant operational wallets first began receiving funds as early as September 24, then successively tested multi-chain transfers, approvals, and fund consolidation processes, and deployed automated fund transfer mechanisms in advance. These signs indicate that behind this theft incident there may have been an organized attack operation.
Authorized Reseller's Quiet Change of Ownership Sparks Speculation, CryptoBilis Suspends Sales in Multiple Countries
CryptoBilis was thus thrust into the spotlight. Unlike unknown-channel vendors, CryptoBilis was Ledger's official authorized reseller in Malaysia, Indonesia, and the Philippines, and the two sides had cooperated for about 5 years. However, as the attack incident escalated, this long-term cooperative relationship also began to be questioned.
Former CryptoBilis CEO Arravind Prabu then came forward to respond, saying that he had exited the company earlier this year, that CryptoBilis had previously been acquired, that he no longer participated in any operations or management affairs, and that he no longer had access to the relevant systems and could not access the company's accounts, backend, or business systems. At present, the CryptoBilis account is operated by the new management team, and the related posts were also published by the new team. Due to contractual confidentiality clauses, he is legally obligated to refrain from publicly issuing related announcements until October 19. He also said he was willing to provide historical background information to Ledger to assist the investigation.
However, this response did not calm community doubts. Some users accused Arravind Prabu of selling the company without disclosing it to Ledger, while others questioned whether Ledger failed to timely review changes in the equity and operating conditions of its authorized reseller.
According to information disclosed by Bitcoin News, as of August 3, an individual named Jiaming, with a registered address in Heilongjiang Province, China, held 100% of CryptoBilis's shares. It is worth mentioning that this new director resigned on September 7.
The change of ownership at the reseller, the confidentiality period, and this wallet theft incident overlapped, further deepening market suspicion of CryptoBilis. In particular, in addition to Ledger, this reseller also sold hardware wallets from multiple brands including Trezor, SafePal, Tangem, and OneKey, which also drew more attention to the scope of the incident's impact.
However, as of now, there is no conclusive evidence showing a direct connection between the equity change at CryptoBilis and the tampering of Ledger devices. From factory shipment to final delivery to users, a hardware wallet may pass through multiple stages including manufacturing, transportation, warehousing, and distribution. Problems at any stage may introduce additional security risks.
After the incident, CryptoBilis suspended the sale and shipment of Ledger devices and said that users who had not yet activated their devices should stop setting them up, while users who had already activated them should transfer assets to a new device initialized with a brand-new mnemonic phrase. CryptoBilis also reminded users never to disclose their mnemonic phrase or PIN code, and users who suffered losses should retain their devices and transaction records and call the police.
At the same time, the company further announced that it was suspending the sale and shipment of all branded hardware wallets across all stores and online channels in Malaysia, the Philippines, and Indonesia, and that physical stores were also temporarily closed, adding that further progress was expected to be announced within three working days.
Ledger Allegedly Contains Spy Module, Hardware Wallet Security Questioned Again
Faced with doubts over the Ledger hardware wallet theft, some people disassembled devices for inspection and discovered abnormalities inside.
Former Mt. Gox CEO Mark Karpelès tweeted that a Ledger device he purchased from Malaysia contained a spy module with a SIM card chip inside. Although the shrink wrap on the outer packaging was intact, it was difficult to immediately notice the abnormality after opening it, as the implant was hidden in the position where the screen's buffer pad should originally have been placed.
According to his disclosure, the module contained LTE communication components, an antenna, an eSIM, and a microcontroller connected to Ledger's SPI bus, and was capable of analyzing the characters displayed by the device to the user and sending related data after the mnemonic phrase setup was completed. The attacker may monitor the victim's wallet address and choose the timing to transfer assets.
SlowMist Chief Information Security Officer 23pds also analyzed that the attack process may have been that a malicious module connected to the screen data cable, recorded the words displayed when the mnemonic phrase was generated, and then sent them to the attacker via LTE/eSIM; the secure element can only protect the private key from being read and cannot prevent screen contents from being intercepted.
However, the spy module cannot directly prove a direct connection to this large-scale coin theft incident, nor can it rule out other attack paths. For example, the attacker may have pre-generated the mnemonic phrase and kept a record before the device was delivered to the user, then repackaged the device and delivered it to the user. The user completed setup according to the normal process and seemingly obtained a brand-new hardware wallet, but in fact the corresponding private key may already have been in someone else's hands. Previously, there were also cases in China in which users purchased hardware wallets through e-commerce platforms such as JD.com and Douyin and later had assets stolen because the devices may have been tampered with in advance.In response, SlowMist founder Yu Xian posted on X that after the Ledger reseller incident, hardware wallets may need to adopt a tamper-evident self-destruct mechanism as an important security design, or otherwise provide other mechanisms to prove that users have received an official, original device. However, dForce founder Mindao believes that self-destruction upon disassembly may instead make it harder for users to determine whether a device has been modified, while a removable design would at least allow professionals to inspect the hardware against circuit diagrams. He also pointed out that Ledger's official website already provides a hardware integrity check guide, but it is too hardcore for ordinary users.
In addition, attackers may also exploit customer orders and contact information held by resellers to forge official Ledger emails or set up phishing websites, inducing users to leak their seed phrases during device setup. However, given that the attacker conducted test transfers in advance, this possibility is relatively low.
The final cause of this incident still awaits further investigation and announcement by Ledger, but for the victims, the assets that have already been transferred are likely difficult to recover.
For coin holders, this Ledger theft incident once again sounds the alarm: a hardware wallet does not mean absolute security, and the security of the device itself is only one link in the entire key management chain. Choosing a trusted purchase channel is certainly important, but it is equally necessary to pay attention to device integrity, properly safeguard seed phrases, and remain vigilant against any behavior that asks for seed phrases or PIN codes. Once there is suspicion that a seed phrase has been leaked, assets should be transferred as soon as possible.