2026 Ledger — 335+ Flex devices modified with malicious hardware; recovery phrases exfiltrated; $86–102M stolen
Data compromised
Cryptocurrency wallet recovery phrases (24-word seeds) for 335+ affected devices; attackers then drained on-chain assets. Total losses traced: $86–$102 million across Bitcoin, Ethereum, and stablecoins.
Technical writeup
Verified via Ledger statement, on-chain analysis (Specter, Bitquery, Galaxy Digital), and public blockchain tracing. 335+ devices identified with embedded malicious hardware; discovery Oct 9, statement Oct 18, 2026. Supply-chain node and full scope pending deeper forensic disclosure.
Root cause
Supply-chain compromise (manufacturing or distribution intercept): rogue microcontroller and eSIM module soldered onto legitimate Flex PCBs, intercepting seed phrase generation and transmitting via cellular to attacker infrastructure.