Ledger Faces Major Security Incident Today, $9.5 Million Stolen Due to Fake Apps
Hardware wallet manufacturer Ledger has experienced another security incident today, with third-party security firms estimating losses to be close to $90 million. Ledger is investigating financial losses related to devices sold through its Southeast Asian authorized distributor, CryptoBilis, and has requested the distributor to suspend sales and shipments. Users who purchased devices through this channel in the last 90 days are advised to exercise caution or transfer their assets. The cause of the incident has not been definitively confirmed, but it is suspected to involve supply chain or device tampering risks. Historical incidents of attacks and financial losses related to Ledger include: In 2018, vulnerabilities in early hardware and supply chain research emerged. Security researchers demonstrated the potential for tampering with the Nano S before it left the factory, as well as issues like MCU bootloader bypass, isolation vulnerabilities, and Bitcoin change address injection. Ledger issued security announcements and completed repairs, with many issues being research-level vulnerabilities or requiring physical access to exploit. In 2020, Ledger suffered a massive customer data leak. Attackers accessed e-commerce and marketing databases through third-party API keys and Shopify-related vulnerabilities, exposing over 1 million email addresses and approximately 272,000 to 292,000 customer records, including names, addresses, and phone numbers. Hardware and private keys were not affected, but the incident led to long-term phishing, social engineering, and counterfeit official letter scams. In December 2023, the Ledger Connect Kit faced a supply chain attack. After a former employee fell victim to a phishing attack, their NPMJS account was compromised, and attackers released a malicious version of the Connect Kit, injecting malicious code into DApps relying on the library, tricking users into signing fraudulent transactions. The active attack window lasted about 2 hours, resulting in losses of approximately $480,000 to $600,000. The hardware and Ledger Live itself were not directly breached. In January 2026, a data leak occurred involving third-party Global-e order data. Unauthorized access to payment and logistics partners' systems exposed some Ledger.com order-related information, including names, addresses, and contact details. Ledger's own systems and private keys were unaffected, but the phishing risk increased again. In April 2026, a counterfeit Ledger Live application scam appeared on the App Store. The imitation app was listed for about a week, tricking users into entering their recovery phrases, resulting in losses of approximately $9.5 million for over 50 victims across multiple blockchains. Apple subsequently removed the app, and Ledger emphasized that it would never ask for 24-word recovery phrases. In August 2026, Ledger disclosed vulnerabilities related to Ethereum application signatures, including command interleaving causing display content to be out of sync with signature parameters and clear-signing bypass issues. These vulnerabilities required collaboration with a malicious host, and Ledger stated there was no evidence of actual user exploitation; the issues have been fixed in a new version. On October 9, 2026, a large-scale wallet draining incident related to the CryptoBilis distributor occurred, with estimated losses nearing $90 million. Ledger is investigating, and the incident is suspected to involve supply chain or device tampering attacks targeting a single channel. The official sales have been suspended, and affected users are advised to migrate their assets.
