Update for XRP Holders: Entire Ledger Wallet Supply Chain Is Under Attack

The Ledger hack was supposed to be contained to Southeast Asia. Crypto commentator Fto raised the alarm for XRP holders and the broader crypto community, reporting that the same compromised hardware found in devices sold through Malaysian reseller CryptoBilis is now surfacing at retailers in Europe.

Devices carrying hidden LTE-enabled spy chips have begun crossing borders, and the attack on Ledger’s supply chain appears far larger than initially reported.

Fto warned that waiting for a U.S. confirmation is reckless and urged holders to secure their positions by moving their assets immediately.

Ledger will never recover from this.

The entire supply chain is under attack. It’s no longer isolated. It’s EVERYWHERE.

Reports tied it all back to Asia, now the exact same malware is being found at Europe retailers.

The Original Attack

The hack began with CryptoBilis, a Ledger-authorized reseller serving Malaysia, Indonesia, and the Philippines. Attackers physically modified Ledger Nano X devices before they reached buyers. They fitted a small secondary circuit board inside each unit, hidden beneath the screen. The board carried an LTE modem and an eSIM.

When a user set up the device, the 24-word seed phrase appeared on screen. The implant captured those words and transmitted them over a mobile data connection. The attacker then used the stolen seed phrases to access wallets remotely. Ledger’s own authenticity check passed these devices because the original secure chip remained untouched. Only the added hardware was malicious.