Ledger investigates $86 million cryptocurrency theft linked to suspected fake wallets

Disclaimer: Content does not constitute investment advice. Trading involves risks—please invest with caution!

Ledger 启动调查：逾 8600 万美元加密货币疑似因东南亚经销商渠道的假冒硬件钱包失窃

据报道，在通过东南亚经销商 CryptoBilis 购买硬件钱包后，超过 8600 万美元的加密货币从客户账户中消失。Ledger 已就此事件展开调查。涉事设备被怀疑是伪造的，或在交付给用户之前已被篡改。

调查损失来源

Ledger 已指示 CryptoBilis 暂停所有销售和发货，以便公司查明漏洞是如何发生的。该公司强调，调查仍在进行中。

链上分析师 Specter 追踪了被盗资金在三大主要区块链网络——比特币（Bitcoin）、以太坊（Ethereum）和 TRON 上的流向。Specter 发现了来自数百个受害者钱包的存款，这表明这是一起针对特定设备的协调性攻击方案。

证据表明，该事件可能源于仅限于单一经销商的供应链攻击，而非 Ledger 硬件存在广泛的安全缺陷。币安创始人赵长鹏（CZ）强调了这一观点，并向近期购买 Ledger 设备的用户发出警告。

报告指出，盗窃地址接收到了来自以太坊、TRON 和比特币上数百个受害者钱包的资金流入，凸显了影响多个区块链的重大安全事件。

虚假硬件钱包如何暴露用户资金

Hardware wallets are designed to protect users 'assets by keeping private keys offline and away from Internet-based threats. However, this security is only effective if the device itself is authentic and has not been compromised during the supply chain.

If attackers distribute counterfeit or tampered devices through dealers, they could obtain user funds immediately after the device is initialized, thereby bypassing standard protection measures for hardware wallets.

Details of how these tampered wallets were stolen have not yet been disclosed. Ledger is reviewing each affected product to determine the exact fraud methods used.

Identified theft addresses begin with familiar suffixes: Bitcoin addresses begin with "bc1q", TRON addresses begin with "T", and Ethereum addresses begin with "0x". This pattern demonstrates the cross-chain nature of events, indicating that the attacker targeted a wide range of assets.

Although the reported losses exceeded US$86 million, full details on the number of victims affected, the distribution of assets across blockchains, and any recovery efforts remain to be released.

Guidance and security measures for Ledger users

Ledger's suspension of CryptoBilis sales is a precautionary step aimed at clarifying the scope of the vulnerability. This action does not mean that all Ledger hardware wallets are affected or insecure.

CZ stated that the existing evidence is consistent with targeted supply chain attacks targeting specific vendors, which means only a limited group of users is at risk.

CZ warned: "If you use a Ledger hardware wallet, especially if you purchased it recently, please proceed with caution. From what we know, the attack appears to be limited to specific vendors, and some may have purchased counterfeit or tampered with equipment."

The incident has drawn attention to risks that include not only software vulnerabilities or exchange leaks, but also physical tampering of hardware devices before reaching consumers. Buying wallets from trusted official sales channels is critical to asset security.

Users should always follow the manufacturer's instructions to verify the authenticity of the new wallet and set up the device. Users who suspect that their wallets may have been compromised should avoid entering mnemonic words in unverified software and transfer funds after confirming the authenticity of the device.

The response to this incident highlights the critical role of blockchain analytics in tracking stolen funds and providing clues to investigations. Specter's analysis of addresses associated with the theft showed that tracing remains feasible even if funds move between multiple chains.

在美联储利率决策或突然的山寨币上市等变化可能对市场产生快速影响的环境中，投资者越来越多地选择注重隐私、流程简化的平台。借助相关工具，交易者可以在单一界面上查看实时图表、设置自定义价格警报、监控特定币种头条新闻以及访问关键的宏观数据，而无需创建账户。这种方法节省了时间，减少了对同时操作多个应用程序的需求，并有助于用户避免不必要的投资组合损失。

目前的调查旨在确定设备是如何被入侵的、受影响用户的总人数、各链的损失总额以及资产恢复的可能性。预计行业利益相关者将协助追踪并可能冻结被盗资金。