Ledger reviews reseller rules after crypto wallet theft

Ledger is reviewing how its hardware wallets are sold and checked for tampering after an implanted device was linked to an estimated $90 million in stolen cryptocurrency. Bloomberg Law reported the review and Ledger’s request for resellers in Southeast Asia and Hong Kong to suspend sales. The company said the incident involved an unauthorized implant in at least one device.

What is Ledger reviewing?

Ledger says it is reviewing controls for its direct sales and reseller channels, along with protections against physical tampering. Its response to the hardware implant attack says the company asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. Ledger said there was no flaw in its chip, operating system or servers.

The review follows a theft affecting wallets sold through CryptoBilis, a reseller in Southeast Asia. The amount is an estimate, not a confirmed total. Early reports put suspected losses at different figures, and the losses had not been independently confirmed. A hardware wallet stores the keys used to access crypto, while a recovery phrase can restore access if the device is lost or replaced.

How did the implant put wallets at risk?

The device contained unauthorized hardware added somewhere in the supply chain, meaning the route from maker to buyer. Bloomberg reported that spyware in some wallets was tied to the theft. Ledger confirmed finding an implant in one affected user’s device, but the company has not said where in the supply chain it was added.

That matters because a physical change to a wallet can put a user’s recovery phrase at risk even when the wallet’s software and the company’s systems are not compromised. Ledger said its own systems and direct sales channels were unaffected, according to its public response.

What should CryptoBilis customers do?

Ledger’s earlier guidance was for customers who bought from CryptoBilis in the previous 90 days to avoid setting up an unused device. Customers who had already set one up were told to consider moving their assets to a new signer with a new recovery phrase. A signer is the device used to approve crypto transactions.

Ledger’s review now covers how devices reach buyers and how the company can detect physical changes. The company has not announced specific new safeguards or a timetable. Its response says the investigation is ongoing.

Sources

• response to the hardware implant attack — support.ledger.com