Ledger's historical security incidents: $9.5 million was stolen from fake apps, and today's theft is the largest

On October 9, 2026, hardware wallet company Ledger encountered another security crisis. A third-party security agency estimated that the economic loss caused by this incident was close to US$90 million. The company has launched an investigation into the equipment sales process of CryptoBilis, an authorized dealer in Southeast Asia, requiring it to immediately stop sales and logistics distribution, and reminded users who purchased machines through this channel in the past 90 days to be alert to potential security risks, and recommended timely transfer of digital assets. The cause of the incident is still under verification, initially pointing to the possibility that the supply chain or terminal equipment has been tampered with.<br /> <br /> Sort out the development of Ledger security incidents:<br /> - 2018: Early hardware and supply chain security vulnerabilities were intensively exposed. Security experts revealed that Nano S devices were at risk of being tampered with before leaving the factory, and also exposed security risks such as MCU boot bypass mechanisms, isolation failures, and Bitcoin change address injection. Companies gradually fix vulnerabilities by issuing security notices, but most problems still require physical contact with equipment to be triggered.<br /> - 2020: Large-scale leakage of customer data. The attacker used third-party API keys and Shopify system vulnerabilities to invade the e-commerce platform database, resulting in the disclosure of more than 1 million email addresses and 272,000 to 292,000 pieces of customer information (including names, addresses, contact information, etc.). Although hardware storage and private keys were not directly damaged, the incident directly triggered long-term phishing, social engineering attacks and forged official email scams.<br /> - December 2023: Supply chain attack. A former employee was attacked by phishing and took control of the NPMJS account and released a tampered malicious version of Ledger Connect Kit. The malicious component was injected into a DApp that relied on its library, inducing users to sign stolen currency transactions involving a total amount of US$480,000 to US$600,000. Companies emphasize that hardware devices and Ledger Live software itself have not been directly attacked.<br /> - January 2026: Order information leaked. Unauthorized access to the Global-e system of the payment logistics partner resulted in the disclosure of some Ledger.com order fields (including user name, address, contact information, etc.). Companies confirm that their systems and private keys are not compromised, but further exacerbates the threat of phishing attacks.<br /> - April 2026: App Store fake app fraud. The fake Ledger Live app was available on the platform for about a week, tricking users into entering mnemonic words and stealing assets. More than 50 victims lost a total of approximately US$9.5 million, involving multiple blockchain networks. Apple subsequently removed the app, and Ledger reiterated that it would not require users to provide 24-word mnemonic words.<br /> - August 2026: Defects in the Ethereum signature mechanism. Multiple vulnerabilities (such as LSB-023) have been disclosed, including misordering of command execution resulting in abnormal display of signature parameters, and bypassing of the Clear-signing mechanism. The company said there was no conclusive evidence that users were being exploited, and the relevant vulnerabilities had been fixed in the new version of firmware.<br /> - October 9, 2026: The latest dealer related incident. The wallet emptying incident related to the CryptoBilis channel has attracted attention, with estimated losses of nearly US$90 million. The company has launched an investigation process and initially judged it to be a supply chain or equipment tampering attack targeting specific sales channels, and has taken countermeasures such as suspending sales and recommending asset migration.