Ledger
6 incidents, 2 live. 13 days since the last new one.
6 drains in the last 12 months
6 drains in the last 12 months
6 drains in 2026
Live
-
Critical◐Partly contained
Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M
Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct.
Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers·Tron, Ethereum, BNB Chain, Polygon, Solana, Bitcoin·$102M stolen·Since Oct 9, 2026·
-
High◐Partly contained
19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons
Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available.
Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'·Multiple EVM chains, Solana, Tron·Since Aug 30, 2026·
Past
April 2026 3
-
High◐Partly contained
Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases
Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published.
iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps·Multiple EVM chains, Bitcoin, Tron·Since Apr 20, 2026·
-
High✕Still active
notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies
Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published.
Mac users with Ledger Live, Trezor Suite or desktop/extension wallets·Bitcoin, Multiple EVM chains·Since Apr 10, 2026·
-
Critical◐Partly contained
Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts
A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase.
Ledger users who installed 'Ledger Live' from the Mac App Store·Bitcoin, Ethereum, Tron, Solana·$9.5M stolen·Since Apr 8, 2026·
January 2026 1
-
High✕Still active
Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps
SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published.
Linux users installing wallet apps from the Snap Store·Bitcoin, Multiple EVM chains·Since Jan 21, 2026·
No drains match these filters.