Ledger Says Organized Crime Group Spent Millions Targeting Wallet Users

Ledger, the Paris-based hardware wallet maker, says an organized crime group spent millions of dollars on a campaign against its users. In a statement reported this week by Bitcoin Magazine, the company called the operation a "sophisticated" supply chain attack. The stakes are plain. Hardware wallets exist for one reason: to keep private keys away from anyone who wants them. If a criminal group thinks it is worth spending seven figures to get between a manufacturer and its customers, then the attackers expect a far larger return. The people holding the coins pay that return.

The Attack Ledger Describes

The public record is still thin. Ledger has confirmed three things through its statement. The attackers were organized. They were well funded, with spending in the millions. And they went after the supply chain, the path a device or its software takes from the factory to the user's desk.

That last point matters most. Phishing emails and fake support accounts are cheap. A supply chain attack is not. It can mean tampered devices, counterfeit packaging, compromised resellers, poisoned software libraries, or insiders at logistics firms. Each of those needs money, people, and patience. A group that pays for that work is not running a weekend scam. It is running a business with a budget, a target list, and an expected margin.

Ledger has not yet published a full technical postmortem with stolen totals, victim counts, or a timeline. Until it does, any specific loss figure is speculation. Readers should treat claims circulating on social media with the same skepticism they would apply to an unsigned transaction.

The core lesson does not depend on those details. The attackers aimed at the trust between a vendor and its buyers. The math of the keys was never the weak point.

A Long Record of Targeting

Ledger users have been in criminal crosshairs for six years. The pattern is consistent, and each episode built on the last.

In July 2020, Ledger disclosed a breach of its e-commerce and marketing database. About 1 million email addresses leaked. For roughly 272,000 customers, the leak included full names, postal addresses, and phone numbers. In December 2020 the full dataset was dumped publicly on a hacker forum. From that point on, anyone could get a list of people who had bought a hardware wallet and where they lived.

The consequences arrived fast. Customers received phishing emails, SMS messages, and threatening calls. In 2021 some received physical packages in the mail containing tampered devices and forged letters telling them to "replace" their old wallet. The fake devices were built to steal recovery phrases. That was an early, crude form of the supply chain attack Ledger is now describing at scale.

On December 14, 2023, attackers compromised the NPM account of a former Ledger employee. They pushed malicious code into Ledger Connect Kit, a JavaScript library used by many decentralized applications. For a few hours, users connecting wallets to affected sites were served a drainer. Losses were reported at roughly $600,000 before the code was pulled. The incident showed that a single compromised credential in a software dependency can reach thousands of users who never touched a Ledger server.

Then the threat turned physical. On January 21, 2025, Ledger co-founder David Balland and his partner were kidnapped from their home in central France. The kidnappers cut off one of his fingers and demanded a cryptocurrency ransom. French police freed both of them within about two days and made multiple arrests. Through 2025, France saw a string of similar abductions and attempted abductions of crypto holders and their relatives. French authorities responded with new protective measures for people in the industry.

The broader industry offers the same lesson. In May 2025, Coinbase disclosed that criminals had bribed overseas support contractors to pull customer data. The exchange refused a $20 million extortion demand and estimated its own remediation costs at $180 million to $400 million. Regulatory filings put the number of affected customers at around 69,000.

The thread across all of it is data. Names, addresses, purchase histories, and account balances are the raw material. A group that spends millions on a supply chain attack is usually building on top of data it already has.

Why Spend Millions

Criminal groups do not spend millions out of spite. They spend because the expected payout is larger.

Consider the target. Hardware wallet owners are, almost by definition, people who hold enough crypto to care about cold storage. Many hold Bitcoin bought years ago at a fraction of today's price. A buyer who stored 2 BTC in 2018 sits on a balance that would make any professional thief pay attention. Multiply that across a customer list, and a seven-figure budget looks like a rational investment.

Consider the method. A remote phishing campaign converts a tiny fraction of recipients. A tampered device in the mail, or a poisoned firmware update, or a compromised reseller, converts at a much higher rate. The victim believes the product came from a trusted source. They follow instructions because the instructions look official. A higher conversion rate justifies a higher upfront cost.

Consider the exit. Stolen crypto can move across chains, through mixers, and into over-the-counter desks in jurisdictions that do not cooperate with Western police. Chain analysis firms have become good at tracing flows. Recovery still remains rare. The attackers price that into their plans.

The upshot is uncomfortable. The value secured by self-custody has grown large enough to support a professional attack industry. That is a sign of success for Bitcoin as a store of value. It is also a bill that individual holders must now pay in vigilance.

Two Readings of the Same Facts

Ledger and its defenders read the statement one way. Its critics read it another. Both readings deserve a hearing.

The industry view holds that this is what success looks like. Ledger has sold millions of devices over more than a decade. Its secure element chips have never been publicly broken in a way that let remote attackers extract keys from a properly used device. On this reading, criminals are going after packaging, logistics, and users because the device itself holds. A supply chain attack is an admission by the attackers that the cryptography works. Ledger's public statement is also a form of transparency. The company named the threat and warned its customers, which is more than many firms do.

The critics' view is sharper. Ledger has been the common denominator in too many incidents. The 2020 leak put a target on hundreds of thousands of homes, and those people did not choose to be on that list. The 2023 Connect Kit attack came through a former employee whose access was never revoked. And in May 2023, Ledger's announcement of Ledger Recover, an optional service that can split and back up an encrypted version of a user's seed with third-party custodians, angered many users. The company insisted the service was opt-in. Critics replied that the mere existence of firmware able to export seed material changed the trust model. To them, Ledger keeps asking for trust while handing attackers new surfaces.

A second split runs between regulators and self-custody advocates. European regulators, working through the Markets in Crypto-Assets regulation (MiCA) and the DAC8 tax reporting directive, which took effect on January 1, 2026, tend to see more oversight and more reporting as the answer to crypto crime. On that view, licensed intermediaries and tracked flows make theft harder to cash out.

Self-custody advocates see the opposite. Every new reporting rule creates another database of who owns what and where they live. The 2020 Ledger leak and the 2025 Coinbase breach both show that such databases leak. Mandated data collection does not just fail to stop crime. It supplies the target list. The US approach, still split between agencies and state regimes, has produced fewer centralized mandates but no clear protection either.

Both sides agree on one fact. The weakest link is no longer the key. It is everything around the key.

Self-Custody Is Still the Answer

Here is the position. This attack strengthens the case for Bitcoin self-custody. It does not weaken it.

Bitcoin's design gives an individual something no bank or state can: property that can be held directly, verified independently, and moved without permission. That is the whole point of a fixed supply of 21 million coins secured by math instead of by promises. Fiat money depends on trusting a central bank not to debase it and a commercial bank not to freeze it. Bitcoin removes both of those dependencies. Self-custody is the act of claiming that independence in practice.

Criminals going after hardware wallet users do not prove that self-custody failed. They prove that self-custody holds enough value to be worth stealing. The answer is not to hand coins back to custodians. Custodians are honeypots with a single point of failure, and the history from Mt. Gox in 2014 to FTX in 2022 shows how that ends. The answer is better self-custody: verified hardware, minimized personal data, and setups that do not depend on a single vendor.

The deeper problem is the data trail that the financial system and its regulators insist on building. Austrian economists have long argued that property rights are only as strong as the individual's ability to defend them. A regime that forces every purchase, every withdrawal, and every shipping address into a record that can be breached weakens that defense. Privacy is not a luxury for crypto holders. It is a security requirement.

What to Watch

A full postmortem from Ledger. Expect Ledger to publish technical details within weeks: the attack vector, the number of affected users, and the losses. If the company stays vague, trust will erode faster than the attack itself could manage. A detailed report naming the compromised link in the chain would be the best outcome for its users.

Law enforcement action in Europe. French police moved quickly in the Balland case and made arrests within days. An organized group spending millions leaves traces in logistics, payment flows, and recruitment. Expect arrests or indictments, most likely coordinated through Europol, within the next several months. Watch for whether chain analysis firms are named in that work.

Class action pressure. Plaintiffs' lawyers have pursued Ledger over the 2020 leak in US courts. A new incident tied to organized crime will invite fresh suits, especially if victims can show they were targeted using data from earlier breaches. Expect filings in California or New York, and possible complaints to French data protection authority CNIL under GDPR.

A shift toward multisignature setups. Single-vendor, single-key storage is the obvious loser here. Expect growth in multisig coordinators and in setups that mix devices from different makers, such as Trezor, Coldcard, Foundation, and BitBox alongside Ledger. If one vendor's supply chain is compromised, a 2-of-3 multisig across three vendors still holds. Collaborative custody firms like Unchained and Casa will market this point hard, and they will be right to.

Direct sales and verification. Ledger and its competitors will push buyers further toward direct purchases and on-device authenticity checks. Expect stricter warnings against third-party marketplaces, and possibly tamper-evident packaging upgrades. Users should already follow three rules. Buy only from the manufacturer. Run the device's authenticity check. Never type a recovery phrase into anything other than the device itself.

Regulatory overreach. The most likely policy response in the EU will be more reporting, not less. Watch for proposals that tie hardware wallet sales or self-hosted wallet transfers to identity requirements. That would repeat the 2020 mistake at continental scale. Every such list is a future target list.

Physical security as a line item. The 2025 wave of kidnappings in France showed that digital attacks and physical attacks feed each other. Expect more holders to adopt time-locked vaults, decoy wallets, and geographically split backups. Expect insurers to start pricing "wrench attack" risk for high-net-worth crypto clients.

The bottom line is simple. A criminal group spent millions to get at hardware wallet users because those users hold real, scarce, sovereign money. The right response is to hold it better, not to give it up.

---

Go deeper: Seed Phrases Explained

Source: Bitcoin Magazine