Are people really being drained through Ledger wallets? What we can and cannot confirm

Update, 10 October 2026: A thread now ties the losses to a Malaysian reseller sold in secret and a Ledger with a hidden modem inside. Read the full timeline.

A hardware wallet is meant to be the vault. Not a bank, not an exchange, just a small device in your drawer that holds the keys to your coins.

Now a post by the news account Watcher.Guru has people asking whether the vault leaks. The replies came fast. "This is actually terrifying if true," wrote one reader. Another wrote: "Literally let's just stop using Ledger."

Here is what we can say. We found no confirmed new breach of Ledger on 9 October 2026. There is no Ledger statement, no report from a major crypto news outlet and no on-chain investigator confirming a new mass drain. Treat the claim as a claim.

Is Ledger hacked right now?

Not as far as anyone has proven. Searches for a new Ledger statement returned nothing dated this week. In its worst past incidents, Ledger said the devices themselves were not the weak point.

That does not mean the reports are made up. People lose coins from wallets every week. The question is how.

Readers under the post have a theory, and it repeats. One asked for "the rest of the story" and wrote that people buy Ledger hardware from unauthorised sources. Another wrote: "Its a reseller, not Ledger itself." A third said it is a phishing link sent by email.

These are reader guesses, not findings. But they match how earlier drains happened.

How do crypto wallets get drained?

A hardware wallet keeps your private keys offline. A thief cannot just break in from the internet. So thieves go after the person instead.

Security reports and Ledger itself have described three routes:

• Fake or tampered devices. In April 2025, a crypto wallet reseller told reporters that some users had received fake devices built to install malware.
• Phishing. Fake emails, fake websites and even printed letters ask for your 24-word recovery phrase. Anyone who has that phrase owns your coins.
• Poisoned software. In December 2023, attackers slipped bad code into a tool that websites used to connect Ledger wallets.

In each case the user or a connected tool was the door, not the chip inside the device.

Photo: Motokoka / Wikimedia Commons, CC BY-SA 4.0

Every Ledger incident so far, with dates

Ledger has had a rough run. One reader said this is "like the 8th strike." We could not match that exact count, but here is the list we could confirm from news reports.

Notice what is missing. In none of these did a thief crack open the device itself, going by Ledger's statements and the press reports above.

The data leaks matter for another reason. Leaked names and addresses make later phishing look real. A letter with your name, your address and Ledger's logo is hard to ignore.

Is self-custody still safe?

This is the argument raging in the replies. One reader wrote that the only time they were drained was from a wallet. Another said "self custody has trust issues." Some joked about buying theirs at a garage sale.

The joke lands because it is close to the truth. A second-hand or odd-source device is the riskiest way to start.

Self-custody moves the risk from a company to you. Exchanges get hacked. Wallets get tricked. We are not telling anyone where to keep their money.

One reader asked, "So-called Lazarus Group again?" We found nothing linking the North Korean hacking group to this claim. It is a guess.

Photo: FlippyFlink / Wikimedia Commons, CC0

How do you tell if your hardware wallet is safe?

Here is the checklist. It takes two minutes and every step maps to a past incident.

1. Buy direct. Order from the maker's own site or a retailer the maker lists. Never from a marketplace seller, a garage sale or a stranger.
2. Check the packaging. The box should arrive sealed. A device that arrives already set up, or with a pre-written recovery card, is a red flag.
3. Write your own 24 words. The device should generate them in front of you. Never type them into a computer, phone, website, email or support chat.
4. Ignore any message asking for them. Ledger says it will never ask for your recovery phrase by email, QR code, phone or post.
5. Read the device screen. Confirm the address and amount on the hardware itself before you approve anything.

Add one more habit. Get Ledger Live only from the official site, and type the web address yourself instead of clicking an email link.

What happens next?

Three things to watch. Whether Ledger answers the claim. Whether on-chain trackers tie any drains to one source. And whether the post names real amounts or victims.

Until then, the vault in your drawer is only as strong as your habits. The thieves need your 24 words, and now you know nobody legitimate will ever ask for them.