Hackers Steal $86 Million in Cryptocurrency from Ledger Cold Wallets

Image: Wylsacom · Source

Criminals have stolen between $70 million and $90 million from private cryptocurrency cold wallets linked to Ledger, with malware suspected to be preinstalled on devices sold by a reseller.

A significant theft involving cryptocurrency cold wallets has come to light, with criminals extracting an estimated $70 million to $90 million in assets stored on Ledger wallets used by private individuals. The affected devices were reportedly purchased through a Malaysian reseller, CryptoBilis, recently acquired by a private individual from China. Cybersecurity experts suspect that these wallets were compromised by preinstalled malware containing a modem designed to intercept the wallet’s seed phrase, which is essential for accessing the funds.

Victims of the hack have publicly reported unauthorized withdrawals; one Reddit user noted that nearly 100,000 USDT was drained from their Ledger wallet despite the seed phrase being handwritten and stored securely in a safe. This wallet was used only to receive funds, without any other operations performed manually.

Ledger has initiated an investigation into the incident and has advised all customers who bought wallets through CryptoBilis to avoid activating them for the next three months to prevent further losses.

While the exact total amount stolen is still being confirmed, the incident highlights the risks associated with hardware wallet supply chains and the importance of secure device sourcing. This attack has been widely covered by security experts and cryptocurrency news outlets, underlining the severity of the breach and the evolving threat landscape for cold wallet users.