The tampered Ledger wallet theft grows to about 90 million dollars, and one of the biggest victims was a scammer

Hardware wallets are supposed to be the safest way to hold crypto. A case unfolding in Southeast Asia shows what happens when the device itself is compromised before it reaches the buyer. Losses linked to tampered Ledger wallets sold through a regional reseller have grown to an estimated 90 to 93 million dollars across more than 300 wallets, after early reports put the figure above 86 million dollars, as first reported by CoinDesk.

The case has taken an unexpected turn. According to 24/7 Wall St, one of the biggest victims was a crypto scammer, with reports putting that individual's loss at about 4.8 million dollars. The twist does nothing to ease the pain for hundreds of ordinary users, but it shows how indiscriminate supply chain attacks can be.

How the attack reportedly worked

According to reports, the tampered devices contained implants that captured each user's 24 word recovery phrase during setup and transmitted it over an LTE cellular connection using an embedded eSIM. The recovery phrase is the master key to a crypto wallet. Anyone who has it can recreate the wallet and move the funds, which is why it is never supposed to leave the user's hands.

Because the theft happened at setup, victims could do everything right afterwards and still lose their funds. The attackers simply waited until wallets held enough value and then drained them, with more than 300 wallets reportedly affected.

Ledger has said that the number of affected devices is limited and that every confirmed loss involves a device sold by CryptoBilis, the reseller at the centre of the case. The figures and the exact technical details come from early reporting and have not all been independently verified.

Ledger's response

Ledger moved to contain the damage by asking distributors in seven Asian markets to suspend retail sales while it investigates, according to reports. That step aims to stop potentially compromised devices from reaching more buyers and to reassure customers that the problem is being addressed.

The company has stressed that the issue relates to devices sold through a specific reseller rather than a flaw in Ledger's own manufacturing. That distinction matters for the brand, but it also highlights a broader truth about hardware security: the chain of custody from factory to buyer is only as strong as its weakest link.

A hardware wallet protects your keys only if no one else touched it first, which makes where you buy it as important as what you buy.

We first covered the case in our report on tampered Ledger wallets sold through a Southeast Asian reseller. The rising loss estimates and the sales suspension show it is larger and more serious than early reports suggested.

The scammer twist

The revelation that a crypto scammer was among the largest victims has drawn attention. Supply chain attacks do not discriminate between honest savers and criminals; anyone who bought a compromised device and stored value on it was exposed. In this case, illicit funds were swept away alongside the savings of ordinary users.

The detail also hints at how widely the tampered devices circulated. A scammer holding millions in crypto might be expected to take security seriously, yet still bought a device through the affected channel. That underlines how convincing tampered products can be and how hard they are to spot.

For investigators, the involvement of illicit funds complicates the picture. Tracing stolen crypto now involves money that may itself have come from fraud, which could draw interest from law enforcement in several countries.

What it means for crypto holders in Southeast Asia

Southeast Asia has one of the world's most active crypto user bases, and many people buy hardware wallets through local resellers or online marketplaces rather than directly from manufacturers. That convenience creates risk, as this case shows.

The practical lessons for anyone holding crypto are clear:

• Buy hardware wallets directly from the manufacturer or its officially listed partners.
• Never use a device that arrives with a recovery phrase already written or set up.
• Generate the recovery phrase yourself and keep it offline and private.
• Be wary of unusually cheap devices or sellers on unofficial marketplaces.

Exchanges and regulators across the region have warned for years about phishing and fake apps. Supply chain attacks on hardware add a new dimension, targeting the very tools people use to protect themselves from online threats.

The wider security picture

The Ledger case arrives during a difficult period for crypto security. North Korean hackers have pushed their 2026 thefts above 1 billion dollars, according to Chainalysis, and exchanges continue to face sophisticated attacks. Self custody is often promoted as the answer to exchange risk, but this case shows that self custody has its own vulnerabilities.

The industry's response will likely include stronger verification of devices, tamper evident packaging, firmware checks that detect unauthorised hardware and closer oversight of resellers. Manufacturers may also tighten distribution, limiting sales to authorised channels in high risk markets.

For regulators, the case raises questions about consumer protection in the sale of security devices. As more people in Southeast Asia hold crypto, ensuring that the tools they rely on are genuine becomes a matter of public interest.

Trust in the hardware

The tampered Ledger wallet case is a reminder that security depends on trust at every step, from the factory to the reseller to the user. With losses now estimated at around 90 million dollars, it is one of the most significant hardware related thefts the crypto industry has seen.

For crypto holders, the lesson is simple but vital: buy security devices only from trusted sources, set them up yourself and guard your recovery phrase above all else. For the industry, the challenge is to make tampering harder to hide, so that the safest way to hold crypto lives up to its promise.

The tampered Ledger wallet case has grown into a roughly 90 million dollar lesson in supply chain security. It caught honest savers and, ironically, at least one scammer, and it has forced Ledger to pause sales across seven Asian markets. For Southeast Asia's growing crypto community, the message is that self custody is only as safe as the device and the channel it comes from, and that the safest wallet is one bought from a trusted source and set up with your own hands.