Update for XRP Holders: Entire Ledger Wallet Supply Chain Is Under Attack

The Ledger hack was supposed to be contained to Southeast Asia. Crypto commentator Fto raised the alarm for XRP holders and the broader crypto community, reporting that the same compromised hardware found in devices sold through Malaysian reseller CryptoBilis is now surfacing at retailers in Europe.

Devices carrying hidden LTE-enabled spy chips have begun crossing borders, and the attack on Ledger’s supply chain appears far larger than initially reported.

Fto warned that waiting for a U.S. confirmation is reckless and urged holders to secure their positions by moving their assets immediately.

Ledger will never recover from this.

The entire supply chain is under attack. It’s no longer isolated. It’s EVERYWHERE.

Reports tied it all back to Asia, now the exact same malware is being found at Europe retailers.

The Original Attack

The hack began with CryptoBilis, a Ledger-authorized reseller serving Malaysia, Indonesia, and the Philippines. Attackers physically modified Ledger Nano X devices before they reached buyers. They fitted a small secondary circuit board inside each unit, hidden beneath the screen. The board carried an LTE modem and an eSIM.

When a user set up the device, the 24-word seed phrase appeared on screen. The implant captured those words and transmitted them over a mobile data connection. The attacker then used the stolen seed phrases to access wallets remotely. Ledger’s own authenticity check passed these devices because the original secure chip remained untouched. Only the added hardware was malicious.

Blockchain intelligence firm Bitquery traced losses across six chains: TRON, Bitcoin, Ethereum, BNB Chain, Polygon, and Solana. The total is now more than $100 million taken from over 320 wallets.

The Supply Chain is Compromised

Fto shared an image showing an opened Ledger device with a clearly visible secondary board installed where there should be none. He stated the supply chain is “no longer isolated,” and that compromised devices are “already crossing borders.”

The Community Reacts

What Holders Should Do

Fto’s message to holders is clear: move assets off Ledger now. Hardware wallets used to be highly trusted in the crypto space. While they are still highly secure, this event has caused many investors to reassess their positions. According to Fto, “Ledger will never recover from this.”