Did Ledger Wallet Have Tampering Alerts Months Before $86M Crypto Hack?

Ledger reportedly received hardware tampering alerts as early as December 2025, months before an October crypto theft linked to modified devices sold through a Southeast Asian reseller. Researchers estimate losses exceeded $103.4 million across 530 addresses, prompting Ledger to suspend regional sales and Trezor to reduce its reseller network as investigations continue.

Karpelès said Ledger Wallet had received tampering reports since December 2025.

Amid the crypto hack, Joe Grand reported a compromised Lazada-purchased Nano X.

The October 9 disclosure involved CryptoBilis, an authorized Southeast Asian reseller.

Ledger Wallet faces questions its handling of earlier security reports following cryptocurrency thefts linked to modified hardware devices. Former Mt. Gox CEO Mark Karpelès said the manufacturer knew suspicious devices months before the October incidents.

Following the crypto hack, security researcher Joe Grand also reported finding a compromised wallet in March 2026. The October investigation later uncovered unauthorized hardware modifications in devices distributed through Southeast Asia.

Reported losses initially exceeded $86 million before subsequent estimates surpassed $103 million. Ledger Wallet has since suspended regional reseller sales while investigators examine the affected products.

Earlier Ledger Wallet Alerts Emerge After October Security Incident

The investigation has brought renewed attention to warnings that reportedly reached Ledger Wallet before the October crypto scam.

According to Karpelès , the manufacturer began receiving reports tampered hardware wallets in December 2025. Some devices reportedly contained unauthorized electronic components.

However, Karpelès said he had not seen a public warning from Ledger Wallet addressing those earlier findings. He subsequently called for more proactive communication as additional reports emerged.

Separately, security researcher Joe Grand identified problems with a Ledger Nano X purchased through Lazada in Thailand.

Grand informed the manufacturer the compromised device on March 4, 2026. Ledger Wallet acknowledged his report and indicated that its internal teams were investigating. The earlier disclosures gained attention after an October 9 incident involving CryptoBilis, an authorized Southeast Asian reseller.

Investigators subsequently identified an unauthorized implant inside an affected Ledger Wallet device. The discovery established a confirmed case of hardware modification within the regional distribution network.

Crypto Hack Reports Put Losses Above $103 Million

As the investigation continued, blockchain researchers published figures detailing crypto scam losses connected to the compromised devices.

On-chain researchers reported that attackers had taken more than $103.4 million from 530 cryptocurrency addresses. This exceeded earlier reports that placed the losses above $86 million.

Meanwhile, blockchain analytics company Chainalysis identified an alleged crypto scam operator among the affected wallet owners.

According to Chainalysis, the operator had recently purchased three Ledger devices containing malicious implants. The compromised wallets contained a total of 60 Bitcoin, or $4.8 million.

Meanwhile, the Ledger Wallet investigation prompted the manufacturer to restrict sales through its regional distribution partners.

Ledger Wallet Halts Reseller Sales as Trezor Changes Distribution Plans

Following confirmation of the malicious implant, Ledger Wallet instructed regional partners to suspend hardware wallet sales during the investigation.

The directive covered Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. Distributors were also instructed to remove Ledger products from store shelves.

However, the manufacturer maintained that confirmed incidents remained confined to Southeast Asia. Ledger said investigators had not established a verified theft involving a device purchased elsewhere.

The regional measures coincided with a separate response from competing hardware wallet manufacturer Trezor.

Following the crypto hack, Trezor announced plans to reduce its authorized reseller network following reports compromised Ledger products. The company described the changes as precautionary rather than a response to problems involving its own devices.

Furthermore, Trezor reported finding no evidence that its hardware wallets had been compromised. Chief Commercial Officer Danny Sanders said the company had contacted selected distribution partners their removal from its authorized network.

Their reseller authorization would end on January 1, 2027. Trezor also planned to stop supplying the affected distributors beginning October 13.

Bitget News: Platform to End Services for Certain Users

Crypto News: Deutsche Bank to Launch Crypto Custody in Germany Soon