Article
Ledger Historical security incident review: Fake applications once caused 9500000 USD to be stolen; today's theft is the largest-scale incident
BlockBeats news,October 9, hardware wallet manufacturer Ledger has again been caught up in a security incident today. A third-party security firm estimates losses in this incident at approximately 90000000 USD. The official team is currently investigating fund losses associated with devices sold by Southeast Asian authorized reseller CryptoBilis, and has required it to suspend sales and shipments. Users who purchased devices through this channel within the past 90 days are advised to proceed cautiously or move their assets. The cause has not yet been finally confirmed, with suspected supply-chain/device-tampering risk.
Reviewing Ledger's major historical incidents involving attacks and fund losses:
2018 year: Early hardware and supply-chain research vulnerabilities emerged in a concentrated manner. Security researchers demonstrated the possibility of Nano S devices being tampered with before leaving the factory, as well as MCU bootloader bypasses, isolation vulnerabilities,Bitcoin change-address injection, and other issues.Ledger subsequently issued security advisories and fixes; most were research-level scenarios or required physical access.
2020 year: Large-scale customer data breach. Attackers obtained e-commerce and marketing databases through third-party API keys and Shopify-related vulnerabilities. More than 1000000 email addresses and approximately 272000–292000 detailed customer records (names, addresses, phone numbers, etc.) were disclosed. Hardware and private keys were unaffected, but the breach directly gave rise to long-term phishing, social-engineering, and forged official-letter scams.
2023 year December：Ledger Connect Kit supply-chain attack. A former employee was phished, resulting in control of a NPMJS account. The attacker released a malicious version of Connect Kit, injecting it into DApps relying on the library and inducing users to sign fund-stealing transactions. During an active window of approximately 2 hours, losses were approximately 480000–600000 USD in scale. The hardware and Ledger Live itself were not directly compromised.
2026 year January: Third-party Global-e order data breach. The payment and logistics partner's system was accessed without authorization, exposing information related to certain Ledger.com orders (names, addresses, contact details, etc.).Ledger's own systems and private keys were unaffected, but the incident again increased phishing risk.
2026 year April: App Store counterfeit Ledger Live application scam. The impersonating application was listed for approximately 1 weeks and tricked users into entering their seed phrases. More than 50 victims lost approximately 9500000 USD, involving multiple chains. Apple subsequently removed it, and Ledger emphasized that it never asks for 24-word seed phrases.