Cold Wallets No Longer Safe? Full Analysis of Ledger Supply Chain Attack: Attack Methods, Fund Destinations, Three Self-Protection Steps

Storing assets in a cold wallet has long been considered the safest self-custody method. However, the incident on October 9 has created cracks in this consensus: over 300 Ledger wallets were emptied within seconds, with losses tracked by on-chain analytics platform Bitquery exceeding $93 million.

These devices were not counterfeits but purchased through Ledger’s official authorized distributor in Southeast Asia.

This is not the first cold wallet incident this year. In August, Coldcard suffered a vulnerability in random number generation, resulting in over $100 million in Bitcoin being stolen. These consecutive events warrant a fresh look at the notion that “cold wallet equals security.”

This article compiles confirmed facts, unverified speculation, and actions users should take.

1. Incident Timeline

Starting October 9, Southeast Asian users began reporting empty Ledger wallets. These compromised devices shared one thing in common: all were purchased through CryptoBilis. CryptoBilis is Ledger’s official authorized distributor in Indonesia, Malaysia, and the Philippines.

Ledger immediately requested CryptoBilis to suspend all sales and shipments, and issued a statement on October 10:

“Ledger can confirm that one of the affected user’s devices contained unauthorized hardware tampering.”

Ledger also emphasized:

• Ledger’s own systems, services, and infrastructure were not breached.
• Devices purchased directly from Ledger’s official website have shown no issues so far.
• All confirmed cases are limited to devices sold through CryptoBilis.

2. Scale of Losses

According to Bitquery’s investigation report, the losses from this incident are as follows. All figures are estimates by on-chain researchers; Ledger has not officially confirmed the total loss amount.

• Total losses Approximately $93.2 million
• Affected wallets 315 wallets across 6 chains
• TRON (primarily USDT) Approximately $70.5 million
• Bitcoin Approximately 203.8 BTC (around $16.8 million)
• Other chains Ethereum, BNB Chain, Polygon, Solana

Other researchers’ estimates range between $72 million and $94 million, with differences mainly due to varying tracking scopes and time points.

The attack was highly organized. Around 1 p.m. Taiwan time on October 9, wallets on TRON, BNB Chain, Polygon, and Ethereum were drained almost simultaneously within the same second; less than an hour later, Bitcoin was swept, with 111 wallets emptied in a single block.

3. Fund Flows

Portion Already Frozen

Tether froze approximately $10 million in USDT on the day of the incident. This highlights the dual nature of centralized stablecoins: the issuer’s ability to freeze assets can serve as a protective mechanism for victims in such events.

Money Laundering Paths

The remaining funds underwent multiple layers of transfers:

• Tornado Cash + Zcash: Between October 9 and 10, hackers sent around 2,990 ETH into the Tornado Cash mixer, then converted them into the privacy coin Zcash for a loop.
• Converted to unfreezable stablecoins: Another approximately $10 million was swapped into USDD, which Tether cannot freeze.
• Other channels: Including cross-chain bridges and multiple decentralized exchanges.
• Money laundering was not clean

Bitquery found that the amounts flowing out of the mixer almost exactly matched the inflows one by one, ultimately tracing to 5 wallets holding a total of approximately $5.35 million in USDC. Since USDC can be frozen by issuer Circle, this portion still has a chance of recovery. Bitquery assessed the correlation as “strong,” but noted that the mixer makes the link impossible to confirm with 100% certainty.

Attack Was Pre-Planned

Bitquery’s timeline shows that hackers had already created receiving addresses as early as September 25, and over the following two weeks conducted around 20 small test transactions each on TRON and Ethereum. This indicates the attack was not spontaneous but executed after preparation and rehearsal.

⚠️ Bitquery’s report is still being updated; the figures above reflect the latest version at the time of writing.

4. Attack Method: An Extra Circuit Board Behind the Screen

This incident was not a Ledger software vulnerability or a server hack, but a physical supply chain attack: the devices were tampered with at some point after leaving the factory and before reaching users.

Device Teardown Findings

Former Mt. Gox CEO Mark Karpelès publicly shared teardown photos of the affected devices. In the position above the screen where shock-absorbing foam should have been, the foam was removed and replaced with a small circuit board. He described the implant as “cleverly hidden in the position where the screen buffer pad should be.”

According to annotations in the teardown photos, the implant includes:

• LTE mobile network module
• eSIM
• Microcontroller (processor board)
• An antenna not present on the original device
• Possible exfiltration path (speculated)

Cybersecurity firm SlowMist proposed a possible attack path:

• When the user first sets up the Ledger, the screen displays a 24-word mnemonic phrase.
• These words are generated by the secure element and transmitted to the screen via the data line (SPI).
• The implanted circuit board taps into this data line, without modifying firmware, touching private keys, or altering any device behavior—it simply “listens” to the screen content.
• After recording the full mnemonic, it transmits the data via its own mobile network.

The most critical aspect of this method: the implant has its own network and does not require the user’s computer connection at all.

⚠️ The above is speculation from third-party teardowns and security teams. Ledger has only confirmed the “presence of unauthorized hardware tampering” and has not verified that the chip actually captured or transmitted the mnemonic.

5. Why Users Did Not Notice

1. Appearance almost indistinguishable. Packaging, seals, and device casing all looked identical to the original.

2. Official checks may not have caught it. Ledger provides a Genuine Check feature. Since this attack did not alter the secure element or firmware, it could theoretically pass the check. Reports citing users also indicate that tampered devices passed Ledger’s software verification. However, Ledger has not commented on this.

3. Mnemonic read at the moment of display. The mnemonic was indeed generated by the user themselves, and the private keys never left the secure element. But at the instant the mnemonic appeared on screen, it was read by the nearby implant.

This is what truly undermined the trust foundation: the statement “private keys never leave the device” remains true, but attackers bypassed it by targeting the display layer.

6. CryptoBilis Suspicion Points

According to company registration records, CryptoBilis changed ownership this year, with the original founding team exiting operations. The former co-founder publicly stated: “We are no longer part of this company.” He claimed no knowledge of subsequent operations and called on the current management team to handle the matter transparently. The exact timing of the equity transfer remains disputed: registration records show August, while the former co-founder claims the acquisition was completed in March.

It must be emphasized:

There is currently no evidence linking the ownership change to the theft.

Ledger has not accused CryptoBilis of tampering with the devices.

Whether the tampering occurred in the distributor’s warehouse, during transit, or if devices were pre-tampered and then entered the authorized channel remains unclear.

After the incident, CryptoBilis suspended sales of all hardware wallet brands, and its stores in the three countries also ceased operations.

European Case (Unconfirmed)

Separately, a European user posted on X claiming to have found a similar implant in a Ledger purchased at German electronics chain MediaMarkt, though no funds were stolen. This claim comes solely from the user and has not been independently verified; Ledger has not responded. This is a key point to monitor: whether the attack has spread to other regions and channels.

7. What You Should Do Now

If you purchased through CryptoBilis in the past 90 days

• Not yet set up: Do not set it up; contact Ledger support directly.
• Already in use: Treat the device as untrusted. Purchase a new device from official channels, generate a fresh mnemonic, and transfer all assets. The original mnemonic should be considered compromised.

If you have already been hacked

• First, transfer remaining assets to a wallet with a new mnemonic.
• Report the crime: Call the 165 anti-fraud hotline or file a report at a police station to obtain an official report. This documentation is usually required for subsequent exchange freeze requests or legal proceedings.
• Contact Ledger official support.
• For larger amounts: Reach out via the official website to the international crypto security response team SEAL 911. The service is free but requires English communication, and SEAL 911 is not a law enforcement agency.

⚠️ Fake “help recover funds” scams will inevitably appear. Anyone who contacts you proactively and asks for your mnemonic is a scammer. Ledger will never ask you for your mnemonic.

Long-term Advice for All Cold Wallet Users

• Buy only from official channels: Do not buy second-hand, and avoid sellers with unclear origins even if prices are lower or shipping is faster. This incident shows that even authorized distributors can be compromised.
• Stay vigilant against scams: Major security incidents always trigger a flood of fake customer service phishing messages.
• Consider multisig for large holdings: Multisig wallets require multiple keys to sign before funds can be transferred (e.g., 2-of-3). Distributing keys across different brands and sources means that even if one device is tampered with, attackers cannot move funds alone.

8. Summary

Overall, this incident should not be interpreted as “cold wallets are unsafe, so exchanges are better.” There have already been more than enough exchange collapses and hacks in recent years.

The real lesson is: hardware wallet security is not just about the chip—it is about the security of “the chip plus the entire supply chain.” Whether the device you receive is clean is just as important as how strong its internal secure element is.

Changpeng Zhao also commented after the incident: “Self-custody comes with additional responsibility.”

Points worth watching going forward: how Ledger investigates and handles the matter, whether it compensates victims, whether hardware design and distributor controls will be adjusted, and whether the attack has truly spread to other regions. These will determine the long-term impact on Ledger’s brand.