A supply chain security incident has emerged in the hardware wallet sector. According to multiple reports, the attack did not compromise devices remotely; instead, malicious components were implanted during device distribution. These components were capable of decoding seed phrases and transmitting them externally. The affected devices were sold through Southeast Asian distributor channels and ultimately reached users. On-chain institutions estimate that the incident may have caused losses of up to $103 million, affecting multiple hardware wallet manufacturers including Ledger, OneKey, Trezor, and SafePal. At present, multiple independent reports on the incident have been consolidated into the same event for ongoing tracking.
Event developments: Malicious components reached users through distributor channels
Based on information disclosed so far, the key node of the problem is not the device design or firmware update process, but the distribution chain between factory shipment and delivery to users. While users used wallets normally and backed up seed phrases according to standard procedures, sensitive information may already have been obtained by a third party, and this process was difficult for users to detect. The detail that the affected devices were sold through Southeast Asian distributors means that the entry point chosen by the attackers had a channel-based nature, rather than being a targeted attack against a single user.
Scope: Four hardware wallet manufacturers named
According to existing reports, the incident affected multiple hardware wallet manufacturers including Ledger, OneKey, Trezor, and SafePal. Hardware wallets have long been regarded by crypto asset users as core tools for self-custody of private keys, and their security assumption is based on the premise that private keys never leave the offline device. Once seed phrases are decoded inside the device and transmitted externally, this security assumption is broken, and user assets are directly exposed to risk. The reports also noted that the incident has a profound impact on hardware wallet user confidence and the security systems of the entire industry. Notably, the risk involves multiple manufacturers, indicating that the problem is not limited to a single brand or product line but points to broader channel and supply chain management.
Loss estimate: On-chain institutions estimate up to $103 million
Regarding the scale of losses, on-chain institutions estimate losses may reach $103 million, while another measure summarizes them as suspected losses of approximately $100 million. It should be noted that this figure is an estimate made by institutions based on on-chain data and is not a final confirmed loss amount. As follow-up investigations proceed, the number of affected addresses and the scale of transferred assets may still change, and the accuracy of the relevant data remains subject to cross-verification by more independent sources.
Nature of the incident: Supply chain becomes the weak link in the security chain
Unlike common risks such as private key leaks and phishing attacks, the problem in this incident occurred before product delivery. Distributors are an intermediate node between manufacturers and users. Once exploited, malicious components can be deployed without users' awareness, and routine security practices on the user side cannot provide effective protection. For the hardware wallet industry, this means manufacturers' ability to control channels, device integrity, and anti-tampering mechanisms have become areas requiring re-examination.
Industry impact: Trust foundation of the self-custody model tested
Hardware wallets are one of the main storage solutions for long-term crypto asset holding, and their security is directly related to users' trust in the self-custody model. This incident involves multiple manufacturers at the same time, further amplifying market attention to the overall security of hardware wallets. Against the backdrop of continued demand for self-custody, once users' trust in hardware wallets is shaken, it could affect the security narrative of the entire self-custody ecosystem and prompt the industry to reassess verification mechanisms at each stage, including device factory shipment, logistics, distribution, and end delivery.
Follow-up focus
Key areas to watch include: the involved manufacturers' responses and investigation progress, confirmation of affected device batches and distribution channels, further verification of the on-chain loss scale, and whether the hardware wallet industry will form new security norms or standard procedures for supply chain and distributor management. Before the facts are further clarified, this article is based on disclosed information.