Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 
ETH 
TRX TLDR: Core Points
·More than US$86 million in cryptocurrency losses were related to allegedly forged or tampered with Ledger hardware wallets.
· Ledger has asked dealer CryptoBilis to suspend sales and shipments to continue the investigation.
·On-chain analyst Specter tracked the flow of funds between Bitcoin, Ethereum and TRON networks, involving the wallets of hundreds of victims.
· CZ described the incident as a suspected localized supply chain attack against a single supplier rather than an exploitation of Ledger's entire range of products.
Possible course of the Ledger hardware wallet attack
According to reports, this incident has raised concerns about how compromised hardware wallets expose security risks to crypto-assets. Hardware wallets often store private keys offline, reducing the risk of being attacked by the Internet. However, this protection mechanism is based on the premise that the user receives authentic equipment without tampering.
If counterfeit or tampered devices reach the market through dealers, attackers could breach the security of wallets before customers start using the device. The information currently provided does not accurately explain how these suspicious devices contributed to the above-mentioned theft. Ledger's investigation required identifying specific means of intrusion and identifying the range of products affected.
Specter's on-chain analysis identified multiple addresses that received funds from victims, distributed across three major blockchain networks. There have been reports on X (formerly Twitter) and Reddit that some Ledger users have experienced their wallets being emptied. I traced these stolen addresses and found funds flowing into the wallets of hundreds of victims, involving multiple major blockchains such as Ethereum, TRON and Bitcoin.
The addresses identified include Bitcoin addresses starting with bc1q, TRON addresses starting with T, and Ethereum addresses starting with 0x. This cross-chain activity suggests that reported losses extend beyond a single cryptocurrency. Although the reported losses exceeded US$86 million, which was significant, existing information does not provide final details by blockchain, the number of victims identified, or the total amount recovered.
Details on what Ledger users should know about the $86 million crypto theft
Ledger instructed CryptoBilis to suspend sales and shipments as a precautionary measure while the investigation is ongoing. This does not mean that all of Ledger's hardware wallet product line has been compromised. CZ also stated that existing evidence points to a localized supply chain attack involving a single supplier. A small number of people may have purchased counterfeit (or tampered with) Ledger equipment.
For crypto holders, this incident highlights a security risk that goes beyond software vulnerabilities and exchange leaks. Buying hardware wallets through trusted channels can help reduce the risk of exposure to counterfeit products. Users should follow the manufacturer's official instructions when verifying equipment and setting up wallets.
Any user who is concerned about a recently purchased device should avoid entering existing mnemonic words on unverified software or websites. Mnemonic words can directly access funds controlled by the wallet. Users who suspect that their device has been damaged should follow official safety guidelines and transfer assets to a verified secure wallet.
The survey also highlights the role of blockchain analytics in tracking stolen cryptocurrencies across networks. Specter identified multiple addresses related to the reported theft, providing potential clues for investigators to track the flow of funds. CZ said he expects industry participants to assist in tracing and recovering assets.
The key difference now is whether this is a suspected dealer-level breach or a confirmed vulnerability in Ledger's broader hardware wallet system. The investigation must clarify how the equipment was compromised, how many users were affected, and whether there were funds that could be recovered.
