People are being robbed of crypto by a tiny chip implanted in their hardware, with $100 million said to have been stolen already
Ledger, a prominent cryptocurrency hardware wallet manufacturer, has confirmed a supply chain security breach affecting customer assets. Through a reseller, unauthorized hardware implants were placed in at least one user’s device, enabling theft of stored cryptocurrency. The attack has resulted in losses totaling between $86 million and $100 million across affected users, according to analyst calculations and reports.
Ledger initiated an investigation after customers reported missing funds. The company confirmed the presence of an “unauthorised hardware implant” in compromised devices, revealing a critical vulnerability in the product’s distribution chain. This type of supply chain attack—introducing malicious hardware during manufacturing or distribution—poses a fundamental threat to devices explicitly marketed for secure offline storage of cryptocurrency private keys.
The breach is particularly significant because hardware wallets are considered among the most secure methods for storing cryptocurrency, valued specifically for their isolation from internet-connected systems. Customers affected appear to have purchased devices through third-party resellers rather than directly from Ledger, suggesting the compromise occurred at a distribution point rather than in the manufacturer’s own facilities. The incident underscores how even security-focused products can be vulnerable to supply chain exploitation and highlights the importance of verifying device authenticity and supply chain integrity for hardware-based security solutions.