Ledger reviews sales controls after $93 million wallet theft

$93 million in crypto theft linked to tampered Ledger wallets has prompted the company to review how its devices are sold and protected against physical tampering, according to Tom’s Hardware’s report. Ledger CEO Pascal Gauthier said the review covers controls for direct sales and resellers, as well as chain-of-custody and tamper-detection practices.

The incident shows that a wallet’s security can depend on how it reaches you, not just the software running on it.

How did the modified wallets expose recovery phrases?

Ledger said it found an unauthorized hardware implant in a device sold through CryptoBilis, a reseller. The implant’s separate component could read the 24-word recovery phrase used to set up or restore a wallet, then send it over LTE, according to BleepingComputer’s account of Ledger’s findings.

A recovery phrase can give someone control of the crypto held in the wallet. The implant sat outside the Ledger Secure Element and operating system, so it did not alter transactions or signatures and could evade Ledger’s integrity checks. Ledger’s Donjon security team said the implant used a microcontroller and an eSIM to transmit the phrase.

What is Ledger changing while it investigates?

Ledger asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales while it investigates device safety. It also told distributors to source products only through authorized channels and not to restock returned devices, according to the company’s response.

Ledger said all confirmed fund losses in the incident involved devices sold through CryptoBilis. It said its systems and direct sales channel remain unaffected. Some users have reported suspicious devices bought elsewhere, but those reports are not confirmed losses linked to the incident.

What should you take from the sales halt?

The review addresses a gap that software checks alone could not close: a device can pass checks on its firmware while a separate physical component captures information on the hardware. Ledger has asked customers with suspected tampered devices to contact its support team for instructions, and advised people who want to inspect a device to follow its safe-opening guidance.

The estimated $93 million loss is a reported figure, not a total Ledger has confirmed. The company has not yet detailed the changes it will make to reseller oversight or device design. For now, the sales pause and review are its immediate response as it investigates how modified devices entered the distribution chain.

References

• Tom’s Hardware’s report — tomshardware.com
• BleepingComputer’s account of Ledger’s findings — bleepingcomputer.com