Ledger reviews reseller controls after $93 million wallet theft

At least $93 million in cryptocurrency was reportedly stolen through modified Ledger wallets, according to Tom’s Hardware. The incident has pushed Ledger to review how devices reach customers and how its anti-tampering protections work.

Ledger’s chief executive, Pascal Gauthier, said the company is reviewing controls for both direct sales and resellers, according to Tom’s Hardware’s report on Ledger’s policy review. Ledger has also asked resellers and distributors in Southeast Asia and Hong Kong to halt sales while it investigates.

How did the modified wallets expose recovery phrases?

The devices had an unauthorized hardware implant that captured users’ 24-word recovery phrases during wallet setup, according to Ledger and reporting by BleepingComputer. A recovery phrase can be used to restore a wallet and access the crypto it controls.

The implant used a microcontroller to read the phrase from the wallet’s display or hardware data lines, then sent it over an LTE connection using an eSIM. BleepingComputer reports that Ledger confirmed an implant in at least one affected device; the company said all confirmed fund-draining cases involved devices sold through reseller CryptoBilis.

The physical modification sat outside the Ledger operating system and Secure Element, the chip that protects private keys. That meant the implant could evade Ledger’s usual software authenticity check while capturing information shown during setup. The attack did not require the customer to approve a transaction on the compromised device.

What controls is Ledger reviewing?

Ledger says it is reviewing how it handles direct sales and reseller distribution, along with device anti-tampering protections. Gauthier said the company would share what it could, and Ledger has invited researchers and other vendors to help assess supply-chain protections, according to Tom’s Hardware.

The regional sales halt covers Southeast Asia and Hong Kong while investigations continue. Ledger has said its own infrastructure and direct sales channels remain unaffected. It has also reminded authorized resellers to source devices through approved channels and not to restock returned products.

Ledger’s investigation began after users reported unexpected losses on October 9, 2026. The next day, the company confirmed that an affected user’s device contained an unauthorized implant. The reported $93 million loss is an estimate cited by Tom’s Hardware from Bloomberg, not a figure Ledger has confirmed in its statements.

What should you do if you bought a Ledger from a reseller?

Ledger’s guidance depends on whether you have started setting up the device. If your wallet came from CryptoBilis, BleepingComputer reports that Ledger advised customers:

1. If you have not set up the device, do not begin setup.
2. If you have set it up, consider moving your assets to a new Ledger signer with a newly generated recovery phrase.
3. Contact Ledger Support through its official channels if you believe your device was tampered with.

The episode shows how a hardware wallet’s security also depends on the route it takes to reach you. Ledger has not said when its review will conclude or what specific changes it will make to reseller checks or device design.

Sources

• Tom’s Hardware’s report on Ledger’s policy review — tomshardware.com