Ledger, the French hardware wallet manufacturer, is investigating potential tampering with its wallet products after reports that approximately $86 million in cryptocurrency has been stolen from users, according to CoinDesk.

The figure, cited in initial reporting, makes the incident one of the largest suspected wallet-compromise events involving a self-custody hardware vendor. Ledger has not yet published a full technical post-mortem, and the exact mechanism behind the losses — whether a supply-chain breach, a software defect, or a phishing-driven compromise of seed phrases — remains unconfirmed.

What is Ledger investigating?

The company is examining whether its wallets were tampered with before or after they reached customers. Hardware wallet security rests on the assumption that private keys never leave the device's secure element. Any compromise of that chain — during manufacturing, shipping, or through a companion software update — undermines the core value proposition of cold storage.

For Ledger, the stakes are commercial as well as technical. The company has sold millions of devices and also operates Ledger Live, its desktop and mobile application, which connects hardware wallets to blockchains and dApps. A confirmed tampering vector would raise questions across the entire self-custody hardware sector, where competitors such as Trezor and BitBox market on similar security guarantees.

Why the $86 million figure matters

The reported loss amount approaches nine figures, placing it in the same territory as major protocol exploits handled by on-chain investigators and, in some cases, law enforcement. Unlike an exchange hack, however, funds stolen from individual self-custodied wallets are dispersed across many victims, complicating recovery and any coordinated freeze of assets.

Users of hardware wallets hold their own private keys, which means no custodian can unilaterally reverse transactions. Recovery, if possible at all, depends on tracing stolen funds on-chain and pressing intermediaries — exchanges and mixing services — to block deposits.

What should hardware wallet users do now?

No confirmed remediation steps have been published by Ledger at the time of reporting. Standard industry practice in suspected compromise scenarios includes:

• Verifying device authenticity through the vendor's official genuine-check tool
• Generating a new seed phrase on a device purchased directly from the manufacturer
• Avoiding entering recovery phrases into any website, app, or message
• Moving funds from wallets whose seed phrases were ever exposed digitally

What comes next?

Ledger's investigation will determine whether the incident stems from a compromised device batch, a software vulnerability, or attacker-led social engineering against individual users. The company is expected to release findings alongside any recall or patch; regulators in France, where Ledger is headquartered and registered as a virtual asset service provider for certain services, may also seek explanations if the losses trace to a product defect. Until the root cause is established, the $86 million figure and its attribution remain preliminary.