Criminals stole approximately $90 million worth of digital assets last week by tampering with hardware wallets sold by French company Ledger, in one of the most sophisticated crypto-related thefts to date. The devices, designed to securely store passwords offline and protect investors’ digital tokens from hacking, were compromised through the insertion of hidden components that captured users’ recovery phrases during the setup process.

Ledger explained that over several months, organized criminals purchased genuine Ledger devices, opened them, and installed custom-made hardware capable of recording passwords. These altered devices were then returned to circulation through resellers based in Southeast Asia. All the compromised units were sold by CryptoBilis, a Malaysian reseller currently cooperating with Ledger and suspending all sales and shipments amid the ongoing investigation.

The criminals established a coordinated operation with their own infrastructure, including servers for collecting stolen recovery phrases, and mechanisms for draining and laundering the stolen assets. Ledger emphasized that the attack targeted the distribution channel after devices left its control, and that its internal systems were not breached.

In response, Ledger has tightened oversight of its distribution network, reinforcing policies prohibiting the resale of devices in any form, even if they appear new and unopened. Competitor Trezor has also taken precautionary actions, reducing its reseller network to better vet and monitor partners. Danny Sanders, Trezor’s chief commercial officer, highlighted that the security of hardware wallets depends critically on how the devices are sourced, stored, and handled before reaching customers.

The incident has raised concerns within the crypto industry about the increasing risks faced by self-custody platforms. Earlier this year, approximately $116 million was taken from Coldcard wallets after exploiters targeted a system vulnerability. Blockchain analysis firm Chainalysis noted that the crypto crime landscape has become progressively professionalized over recent years, with attackers employing complex and patient strategies.

This latest breach underscores the challenges of securing crypto assets in an evolving threat environment and the importance of vigilance across all stages of hardware wallet distribution and use.