Skip to main content
Crypto News Week

Crypto markets, protocols and policy

Ledger reviews reseller controls after $93M wallet theft

Ledger is reviewing sales and anti-tamper controls after a reseller-linked wallet implant was tied to reported $93 million crypto losses, raising questions about device checks.

The Crypto News Week Editors2 min read

Ledger reviews reseller controls after $93M wallet theft

$93 million is the reported value of crypto losses tied to tampered Ledger hardware wallets. That figure is an estimate of stolen funds; Tom’s Hardware, citing Bloomberg, reported Ledger is reviewing how devices reach buyers and how they resist physical tampering.

A hardware wallet can pass its software authenticity check while a separate component captures the recovery phrase that controls your funds.

What is Ledger changing after the incident?

Ledger CEO Pascal Gauthier said the company is reviewing controls for direct sales and resellers, along with its anti-tampering protections. He said Ledger would share what it can and invited researchers and other vendors to help assess those practices, according to Tom’s Hardware.

Ledger also asked distributors and resellers in Southeast Asia and Hong Kong to suspend sales while it investigates. BleepingComputer reported that the pause covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

How did the modified wallets steal recovery phrases?

Ledger’s security team found an unauthorized hardware implant in a device bought through CryptoBilis, a Southeast Asian reseller. BleepingComputer reported the implant used a microcontroller to read the wallet’s 24-word recovery phrase and a provisioned eSIM to send it over LTE.

The implant was a separate component. It did not alter the wallet’s Secure Element or operating system, so Ledger’s usual integrity checks did not detect it, BleepingComputer reported. Someone with the recovery phrase can recreate the wallet’s keys and access its funds.

What do investigators know about the losses?

Ledger said all confirmed losses so far involved devices sold by CryptoBilis, according to BleepingComputer. The reported $93 million total is not a figure Ledger has confirmed in the material cited by Tom’s Hardware, and the investigation is ongoing.

Users also reported suspicious devices bought from other sellers in Asia and Europe, but those reports do not establish additional confirmed thefts. Ledger said its own infrastructure and direct sales channel remain safe, BleepingComputer reported. If you bought from a reseller, the distinction matters: reports of a modified device call for caution, but they do not by themselves show that your wallet was compromised.

References