Users of Ledger hardware wallets have reported unauthorized withdrawals from their accounts, prompting an investigation into potential supply chain tampering. Suspicion centers on the reseller CryptoBillis, which has been instructed by Ledger to halt all sales of its devices while the company conducts a formal review.
Evidence shared on social media platforms X and Threads suggests that compromised devices contain an unauthorized circuit board hidden beneath the screen. This hardware implant is designed to capture information displayed on the screen, including the seed passphrase generated during the initial setup process.
The malicious hardware utilizes an embedded SIM card to transmit sensitive data to external attackers, who then use the stolen information to drain user funds. Reports indicate that the attackers have successfully siphoned over $86 million in cryptocurrency from hundreds of individual wallets.
Ledger has clarified that there is no evidence of a compromise within its own internal systems. The issue appears to be isolated to devices sold through the third-party reseller CryptoBillis, with the majority of affected users located in Southeast Asia. The company has issued guidance for users to verify the integrity of their hardware.
