Ledger Wallets Were Drained of $100 Million. Is…

PodcastUnchainedMark KarpelèsOct 16

A reported supply-chain attack involved Ledger devices fitted with implants designed to capture seed phrases, with tampered units found through authorized resellers in multiple Southeast Asian jurisdictions. The host reported an estimate of at least $100 million stolen, while the guest said known victim reports understated the scale and that earlier, smaller drains dated back to September 8. The guest sees a possible path to recovering some frozen assets, but expects a difficult, protracted process; he also considers the lack of substantial reported losses outside Southeast Asia a hopeful, unconfirmed sign of containment. The incident highlights the security benefits and tradeoffs of hardware wallets, including the value of inspecting supply chains and weighing direct purchases against authorized resellers.

Cybersecurity Blockchain Risk Management

Preview · 16 more points in the app

Read the Full Summary

Key Takeaways

The guest says the newer Ledger implant is designed for mass production and easier installation, including a Nano X board that clips into place with some soldering; Ledger said the hidden component captures seed phrases during setup. The host reported at least $100 million stolen through the Southeast Asian reseller Crypto Billis, and the guest noted smaller drains as early as September 8 before the larger October 9 wave, while expecting more attacks of this type in the future.

Evidence of tampered Ledger devices has been reported through authorized resellers in multiple Southeast Asian jurisdictions, but Ledger said its checks of devices from German stores and warehouses found no compromised units, and the guest was unaware of reports of drained devices bought in Europe. He views the lack of considerable reported losses outside Southeast Asia as a hopeful—but unconfirmed—sign that the incident may be contained, and cautions against accusing anyone without evidence.

The guest says investigators need to scrutinize the device chain of custody, which passes through multiple hands and is not public; buying directly from Ledger reduces those handoffs but is a tradeoff because authorized resellers can offer other benefits. Vietnam’s cryptographic-device import license can make direct shipments from France difficult for individuals, helping explain the role of authorized resellers there.

GEO-POLITICS

Recovery Hurdles — The guest says recovery is complicated because victims are individuals across multiple jurisdictions and their assets are commingled. Recovering frozen assets may require lawyers, prosecutors, and international law-enforcement cooperation, a process that could take months or years. He is optimistic that some assets could be recovered but doubts it will happen soon.

“Namely, this isn't a single hack of one entity that has lost all of their money…”—

TECHNOLOGY

Scalable Implants — The guest says wallet implants used to be expensive and targeted at specific people, but the newer implant is designed for mass production and easier installation. He expects to see more attacks of this type in the future.

“Typically, this kind of attacks, inserting implants into wallets used to be very expensive. So it would be done on very specific targets…”—

Seed Phrase Theft — Ledger said a criminal group bought genuine devices, fitted hidden components designed to capture recovery phrases during setup, and returned the devices to distribution through Southeast Asian resellers. The implant watches the screen as the seed phrase is displayed. Ledger said checks of devices from German stores and warehouses found no compromised units, so it had not corroborated reports of compromised devices sold by European resellers.

“Their blog post said that a highly organized criminal group over months bought quote genuine Ledger devices, opened them, fitted custom built hidden components designed to capture the recovery phrase…”—

Reseller Tampering — The guest says tampered Ledger devices had been found through authorized resellers in multiple Southeast Asian jurisdictions, including a Ledger Flex bought from authorized reseller Metapod at Singapore airport. He was not aware of reports of drained Ledger devices outside Southeast Asia. Implants found at resellers beyond Crypto Billis led him to say there was more to the story, while cautioning against accusing anyone without evidence.

“It was authorized across Indonesia, Malaysia, and The Philippines, so also multiple jurisdictions. And, yeah, that's what makes this supply chain incident different from many other hardware wallet…”—

ECONOMY

Vietnam Import Rules — The guest says Vietnam requires a license to import cryptographic devices, which can make direct shipments from France difficult for individuals and explains why authorized resellers operate in such jurisdictions. He describes buying directly from the producer as a physical-security tradeoff that reduces the number of hands a device passes through.

“Another reason that's even more basic than this why authorized resellers are used in certain countries have tough laws on the import and export of hardware wallet or crypto graphic…”—

MARKETS

Theft Losses — The host reported an estimate of at least $100 million stolen from Ledger hardware wallets bought through Southeast Asian reseller Crypto Billis. John Tee said inflows to theft addresses exceeded the losses reported by victims who contacted CO 911, indicating that known reports understated the scale.

“An estimated $100,000,000 or more has been stolen from ledger hardware wallets purchased from a reseller in Southeast Asia known as Crypto Billis.”—

Earlier Drains — On-chain analysis indicated that cryptocurrency had been drained before the large wave of attacks on October 9. The guest said the earliest earlier drain he knew of was September 8, and that those losses were smaller.

“The earliest that I'm aware of is September 8, so about a month prior…”—

Unchained Episode Opening

Laura Shen introduces the show, invites audience feedback, and welcomes Mark and John Tee to discuss the Ledger reseller attacks.

Ledger Wallet Theft Reports

John Tee says reports to the CO 911 hotline revealed losses exceeding $100 million, while blockchain flows suggested the known victim reports understated the scale.

Southeast Asia Attack Timeline

On-chain evidence points to smaller drains beginning as early as September 8, with known compromised devices tied to authorized resellers in Southeast Asia.

Ledger Implant Engineering

Mark describes implants found in different Ledger models and explains how their design evolved toward more refined, easier-to-install hardware.

Supply Chain Investigation

The speakers avoid accusing Crypto Billis's new owners without evidence and say investigators must trace the devices through Ledger's private distribution chain.

European Device Claims

Reports of tampered Ledger devices in European stores remain uncorroborated by known victim losses, though Mark confirms examining an implanted device.

Recall And Containment Questions

The guests say a recall could be prudent if European reports are verified, but stress that the scale remains uncertain and caution users against panic.

Authorized Reseller Tradeoffs

John Tee says direct purchases reduce supply-chain exposure, while authorized resellers can protect privacy or help customers in countries with import restrictions.

Self-Custody Security Tradeoffs

The guests argue hardware wallets still reduce online attack risks, but recommend buying directly from manufacturers and improving security guidance and threat modeling.