Ledger wallets drained in supply chain attack costing 80 million dollars
Users in Asia and Europe lost an estimated 80 million dollars after compromised Ledger hardware wallets leaked recovery keys during setup. The incident stems from a reseller that installed hidden chips to transmit data externally.
Reports indicate that users in Asia and parts of Europe had assets drained from their Ledger hardware wallets, with total losses estimated at 80 million US dollars. Investigations revealed that the compromised devices were purchased from a specific reseller in Asia, which had been sold the inventory a few years prior. The reseller allegedly opened the devices before distribution and installed small chips or eSIMs that allowed the recovery keys to be communicated externally during the setup process. This supply chain attack undermines trust in self-custody, a concern heightened by existing quantum computing risks to private key security. Ledger has a history of data breaches, including leaked private addresses in France and a hack of the Ledger Live product. The incident is expected to lead to legal action against the reseller and significant reputational damage for the company.