Ledger Blames an Organized Crime Group for Implanted Wallets Sold in Asia and Pitches a Locked-Down $849 Device

Ledger, the Paris-based hardware wallet maker, said an organized crime group "spent millions" to compromise devices sold to its customers, Bitcoin Magazine reported. Ledger called the operation one of the most sophisticated attacks the industry has seen. According to Ledger, the group built its own logistics, servers to collect recovery phrases, and infrastructure to drain and launder funds. It then waited and carried out one coordinated operation.

The attack vector was a supply-chain compromise. Customers in Southeast Asia lost funds after buying devices from CryptoBilis, a Malaysia-based reseller. CoinDesk reported that an unauthorized implant read users' 24-word recovery phrases from the device screen and sent them out over a mobile network. The implant never had to break the secure chip, because it read the secret at the point where the device displays it to the owner. Blockchain investigator Specter estimated that $86 million had been drained. Ledger has not published its own loss figure. Ledger asked sellers across Asia to stop sales, BleepingComputer reported. The company said it is working with law enforcement to follow the funds. No recovery or attribution to a named group has been announced.

Ledger announced its response to the breach the same week. CoinDesk reports that the new Atom device runs ordinary apps such as WhatsApp and Instagram and switches into a protected mode for managing digital assets. Goku Crypto News reports that Atom is an Android touchscreen device with anti-tamper protections and will be sold only through Ledger's own website, a choice Ledger says is meant to prevent tampered devices from reaching customers. CryptoSlate puts the price at $849, with reservations open and delivery targeted for 2027.

The two announcements address different problems. Selling only direct cuts out the reseller channel that failed. A device that also runs social media and messaging apps, however, adds more software that could be attacked to the same hardware that holds keys. Neither change helps holders whose phrases were already captured.