Bitcoin stolen from Ledger hardware wallets

Ouch. I would never trust a grey imported crypto hardware wallet. Yeah, supply-chain attacks, not even authorized, are all too secure.

I don't see how Ledger can do anything about this? It will hurt their reputation, but that is it.
 
This "wallet" misconception needs to change. The more we use the invalid analogy the more confusion abounds.

The heading should read Bitcoin stolen through compromised private key storage devices.
The bitcoin is not "offline" on the "wallet". The "wallet" is just a private key storage device. Compromise the private key and anyone can access your BTC from anywhere using that PK.
 
  • Like
Reactions: SHL
Companies that sell supposedly secure hardware should be liable for losses suffered by users if their technology isn't really as secure as they claim. At the end of the day, they are not selling a physical device, they are selling the idea that the device is secure, if it isn't then they have sold a lie, and that makes them accountable.
 
Bad Ballie said:
Companies that sell supposedly secure hardware should be liable for losses suffered by users if their technology isn't really as secure as they claim. At the end of the day, they are not selling a physical device, they are selling the idea that the device is secure, if it isn't then they have sold a lie, and that makes them accountable.
Click to expand...
There is no such thing as a secure device. Prove me wrong.
 
Bad Ballie said:
I don't need to, companies that provide these 'secure' devices on the other hand do need to be held liable for selling the lie.
Click to expand...
Says the man posting from an insecure device. :)
Do you do electronic banking from an iPhone or Android phone, knowing they're not 100% secure?
Are you going to blame the companies that supply the hardware and software when it's breached?
 
Last edited:
robinsonia said:
Says the man posting from an insecure device.
How about you stop trusting things instead of wearing blinkers?
Do you do electronic banking from an iPhone or Android phone, knowing they're not 100% secure?
Are you going to blame the companies that supply the hardware and software when it's breached?
Click to expand...
Did someone do something nasty in your cereal this morning? - I am neither your wife, girlfriend nor friend, you want to be the big boy go try it with them. And yes any company that sells me a product which it claims is secure, and it isn't through no fault of my own is going to get sued for any loss I suffer due to their faulure.
 
Bad Ballie said:
Did someone do something nasty in your cereal this morning? - I am neither your wife, girlfriend nor friend, you want to be the big boy go try it with them. And yes any company that sells me a product which it claims is secure, and it isn't through no fault of my own is going to get sued for any loss I suffer due to their faulure.
Click to expand...
You've probably just forgotten about the terms and conditions that you agreed to - or you didn't bother reading them. Sorry to break the bad news.
 
Last edited:
Bad Ballie said:
Did someone do something nasty in your cereal this morning? - I am neither your wife, girlfriend nor friend, you want to be the big boy go try it with them. And yes any company that sells me a product which it claims is secure, and it isn't through no fault of my own is going to get sued for any loss I suffer due to their faulure.
Click to expand...

​


Limitation of Liability​

Except where prohibited by law, in no event will Apple be liable to you for any indirect, consequential, exemplary, incidental or punitive damages, including lost profits, even if Apple has been advised of the possibility of such damages.

If, notwithstanding the other provisions of these Terms of Use, Apple is found to be liable to you for any damage or loss which arises out of or is in any way connected with your use of the Site or any Content, Apple’s liability shall in no event exceed the greater of (1) the total of any subscription or similar fees with respect to any service or feature of or on the Site paid in the six months prior to the date of the initial claim made against Apple (but not including the purchase price for any Apple hardware or software products or any AppleCare or similar support program), or (2) US$100.00. Some jurisdictions do not allow limitations of liability, so the foregoing limitation may not apply to you.

Indemnity​

You agree to indemnify and hold Apple, its officers, directors, shareholders, predecessors, successors in interest, employees, agents, subsidiaries and affiliates, harmless from any demands, loss, liability, claims or expenses (including attorneys’ fees), made against Apple by any third party due to or arising out of or in connection with your use of the Site.


Google Terms of Service – Privacy & Terms – Google

policies.google.com policies.google.com

LIMITATION OF LIABILITY

EXCEPT AS PROVIDED IN THIS WARRANTY AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, APPLE IS NOT RESPONSIBLE FOR DIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES RESULTING FROM ANY BREACH OF WARRANTY OR CONDITION, OR UNDER ANY OTHER LEGAL THEORY, INCLUDING BUT NOT LIMITED TO LOSS OF USE; LOSS OF REVENUE; LOSS OF ACTUAL OR ANTICIPATED PROFITS (INCLUDING LOSS OF PROFITS ON CONTRACTS); LOSS OF THE USE OF MONEY; LOSS OF ANTICIPATED SAVINGS; LOSS OF BUSINESS; LOSS OF OPPORTUNITY; LOSS OF GOODWILL; LOSS OF REPUTATION; LOSS OF, DAMAGE TO, COMPROMISE OR CORRUPTION OF DATA; OR ANY INDIRECT OR CONSEQUENTIAL LOSS OR DAMAGE HOWSOEVER CAUSED INCLUDING THE REPLACEMENT OF EQUIPMENT AND PROPERTY, ANY COSTS OF RECOVERING, PROGRAMMING, OR REPRODUCING ANY PROGRAM OR DATA STORED IN OR USED WITH THE APPLE PRODUCT OR ANY FAILURE TO MAINTAIN THE CONFIDENTIALITY OF INFORMATION STORED ON THE APPLE PRODUCT.
 
Bad Ballie said:
And yes any company that sells me a product which it claims is secure, and it isn't through no fault of my own is going to get sued for any loss I suffer due to their faulure.
Click to expand...

Ignoring the terms for a moment: yes, a company that sells a device through official channels can carry liability if it causes the user a loss. That gets murkier when a bad actor, through no fault* of the company, tampers with the device. Think of a third party implanting hardware in it. There have been reports of devices sold on marketplaces like Amazon with extra hardware inside. Just look at how small this 2.2mm eSIM is!

https://twitter.com/x/status/2108619685751374064
Newsfeed said:
Bitcoin stolen from Ledger hardware wallets

Crypto hardware wallet manufacturer Ledger is investigating a suspected supply-chain attack on devices sold by a specific vendor.
Click to expand...

The real story here is likely this claim:
https://twitter.com/x/status/2108635197662986357

*That said, if the company didn’t have sufficient safeguards against upstream hardware supply-chain attacks, or if an authorised reseller like Cryptobilis had a corporate takeover that muddied who was actually selling the Ledger units, then I can see an argument that the company carries some liability too.
 
Fulcrum29 said:
Ouch. I would never trust a grey imported crypto hardware wallet. Yeah, supply-chain attacks, not even authorized, are all too secure.

I don't see how Ledger can do anything about this? It will hurt their reputation, but that is it.
Click to expand...
Not grey, this was official reseller.
 
robinsonia said:
You've probably just forgotten about the terms and conditions that you agreed to - or you didn't bother reading them. Sorry to break the bad news.
Click to expand...
It's more an it depends, if Apple or Google said they'd never do something and then do it, then they'd most probably be liable, terms and conditions doesn't matter, has to be based on circumstances (e.g. Government forced them).

https://www.reddit.com/r/CryptoCurrency/comments/13v80ri/the_questions_ledger_owes_us_answers_to
 
whatwhat said:
Not grey, this was official reseller.
Click to expand...

I am well aware, but this issue is far more complex.

https://twitter.com/x/status/2109331538072494364

We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products.

Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.

Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.

We are continuously improving that work now and events like this strengthen our resolution: reviewing authorized reseller controls, advancing hardware protections, and cooperating with authorities. Thanks to SEAL_911 for their collaborative support and all their efforts.
Click to expand...

https://twitter.com/x/status/2109240472933671125

PSA the ledger incident isn't limited to Asia.

This is a device purchased in store from an official reseller in Europe (a legitimate device doesn't have any of these cables as can be seen in picture 2)

This even seems to be an old version of the 'spy implant' even though the device was purchased a couple of weeks ago. The newer versions usually hide the implant by the screen so it's easier to miss.

What's interesting is that this compromised ledger never transfered funds to an exploiter. Either the device didn't work or they were waiting for a more widespread usage of the comprised devices? If you own a ledger that didn't directly come from the ledger online store make sure to not just rely on the software genuinely check by ledger but to actually open up the ledger yourself to make sure its original, again there are reported cases in Asia, south America and now Europe as well.

MagicalTux made some useful videos on how to open the ledger and what to look for.
Click to expand...

https://twitter.com/x/status/2109634513957527974

UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well.
@Ledger should initiate an immediate product recall to protect users.

I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet).

The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries).

My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.

Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk.

I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it.

If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
Click to expand...

This is clearly a supply-chain attack, but the man-in-the-middle is steadily being exposed as a grey area. I don't know what has happened here, but there are signs of the possibility of an entity masquerading as being authorised by Ledger.

Anyone restocking returned hardware wallets...

If this is as widespread as the community reports, then Ledger's reputation is shot and users will start questioning the security of hardware crypto wallets. I always tell people that they are crazy for buying Ledger from Takealot.

From what I have seen, Media Markt is even selling refurbished Ledgers. I don't know what that means in terms of refurbishment for a crypto wallet.

Ledger is definitely not "Free from Compromise".

This is the current recommendation from Ledger,

For CryptoBilis buyers: do not initialize unused devices. If already set up, move to a new seed on a device from Ledger.
Click to expand...

yeah.
 
One of the previous owners of Cryptobills posted this on LinkedIn.

www.linkedin.com

CryptoBilis Official Statement from Arravind Prabu and Vimalatheethan | Arravind Prabu posted on the topic | LinkedIn

OFFICIAL STATEMENT REGARDING CRYPTOBILIS In light of recent public discussions and media reports concerning CryptoBilis and Ledger, Vimalatheethan and I (Arravind Prabu) wish to provide full clarity regarding our position and involvement. 1. Operational Handover & Conclusion of Role: Earlier...
www.linkedin.com www.linkedin.com

OFFICIAL STATEMENT REGARDING CRYPTOBILIS

In light of recent public discussions and media reports concerning CryptoBilis and Ledger, Vimalatheethan and I (Arravind Prabu) wish to provide full clarity regarding our position and involvement.

1. Operational Handover & Conclusion of Role:
Earlier this year, CryptoBilis was acquired by new ownership. As part of this transition, Vimal and I officially stepped down and completed a full handover of all operational, managerial, and administrative responsibilities in March 2026.

2. System & Database Access:
Since the completion of the handover, we have held zero access, credentials, visibility, or administrative control over CryptoBilis backend systems, customer databases, order histories, or corporate communication channels.

3. Post-Acquisition Support:
While we assisted the incoming management team in an advisory and coordination capacity during key industry events earlier this year (including Bitcoin Pizza Day, MyBW, and PBW) to ensure a smooth transition, we have had no business or operational visibility into the company's day-to-day management or IT infrastructure.

4. Confidentiality & Public Announcements:
Under the formal acquisition agreements, all parties were contractually bound to hold off on issuing a joint public announcement until mid-October 2026. All suppliers were previously notified of the corporate acquisition and new management structure.

5. Commitment to Security:
Having built CryptoBilis over many years with absolute integrity and dedication to the community, we deeply value user security and our long-standing relationships in the Web3 ecosystem. While we have no active operational standing, we remain open to providing any historical context to Ledger’s team should it assist their review.

For all active operational matters, technical inquiries, or official statements regarding CryptoBilis, please contact the current lead Person in Charge:

Nicholas Chang

Thank you to our partners, clients, and community members who have reached out to support us during this time.

Arravind Prabu & Vimalatheethan
Former Co-Founders, CryptoBilis
Click to expand...

That is just strange.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X