Ledger reviews reseller controls after wallet implant theft

A $93.2 million estimate from blockchain analytics firm Bitquery is prompting Ledger to review how its hardware wallets are sold and checked for tampering. It signals that the reported theft has raised questions about reseller oversight, though Ledger has not published its own loss total. Unchained’s report on Ledger’s reseller update says Bitquery’s tally covers six blockchains and 315 wallets.

Ledger said all confirmed cases tied to the Oct. 9 draining incident involved devices sold through Southeast Asian reseller CryptoBilis, and that its own systems and direct sales channels were unaffected. Bloomberg reported that Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales while the company reviews its sales processes and anti-tampering protections.

What was found inside the affected wallet?

Ledger confirmed that one affected user’s device contained an unauthorized hardware implant. The company has not disclosed how many devices were modified or how the implant was installed.

Tom’s Hardware’s report on the implant describes a cellular module that could capture the device’s screen output or data lines during recovery-phrase setup, then transmit the phrase. A recovery phrase can restore access to a crypto wallet, so exposure can let an attacker take control of funds. Ledger’s official update has not confirmed that technical account in detail.

How much was stolen, and who is linked to it?

The $93.2 million figure is an on-chain estimate, not a total provided by Ledger. Unchained reported that a separate tracker, YFarmX, estimated losses at $103.4 million, illustrating that totals vary with the addresses and blockchains each tracker includes.

Ledger’s public update said every confirmed case it had identified traced to CryptoBilis, which the company described as a Southeast Asia reseller. The company said CryptoBilis had stopped sales while the investigation continued. Ledger has not said the reseller caused the attack, or explained where in the supply chain devices were altered.

The incident matters because a hardware wallet is meant to keep the private keys that control crypto offline. But a device altered before it reaches you can undermine that protection during setup, when a recovery phrase is entered or displayed. Ledger said it is reviewing reseller controls, strengthening distribution and anti-tamper processes, and cooperating with authorities.

What should Ledger customers do now?

Ledger’s guidance, as reported by Unchained, distinguishes between unused devices and wallets already set up. If your device came from a reseller, the company advised customers to:

1. Do not initialize an unused device while the investigation continues.
2. If you already set it up, move funds to a new wallet with a freshly generated recovery phrase on a device obtained through Ledger.
3. Contact Ledger Support through official channels if you suspect your device was tampered with.

Those steps reflect Ledger’s advice to affected customers; they do not establish that every reseller-sold device was modified. Ledger has not reported a confirmed implant in a device purchased through its direct sales channels.

Sources

• Unchained’s report on Ledger’s reseller update — unchainedcrypto.com
• Tom’s Hardware’s report on the implant — tomshardware.com