More than $86 million, from hundreds of wallets, across three blockchains. That is the estimate a pseudonymous investigator known as Specter has put on a wave of thefts reported this week by owners of Ledger hardware wallets. Specter traced the suspected theft addresses on Bitcoin, Ethereum and Tron after complaints appeared on X and Reddit.
Ledger said on Friday that it is investigating. The Paris company acknowledged reports of missing funds from customers who bought their devices through CryptoBilis, a reseller in Southeast Asia, CoinDesk reported.
It has asked CryptoBilis to pause all sales and shipments. Anyone who bought from the reseller in the past 90 days is advised not to set the device up. Those who already have should consider moving their assets to a new Ledger with a freshly generated recovery phrase.
The leading theory is a supply-chain attack. A hardware wallet is only as safe as its recovery phrase, the list of words that regenerates its keys. A device that reaches a buyer with a phrase somebody else already knows can be emptied whenever enough has been deposited.
That would explain why the reports cluster around one seller, and why nothing so far points to a flaw in Ledger’s own systems. The company says it has sold more than 7 million devices. If the theory holds, the weak point is the journey the box took, not the chip inside it.
Almost none of this is confirmed. Ledger has not said any device was altered, has not endorsed the $86 million figure, and has not said how many customers are affected. Nor is it established that the thefts are connected. The number is one investigator’s preliminary count, and early counts in crypto thefts tend to move.
