Ledger tightens reseller rules after $93M wallet theft
Ledger is changing reseller handling after tampered wallets helped steal an estimated $93.2 million, as investigators trace how the devices were altered.
The Aeterna Sol Editors
Up to $93.2 million in crypto was stolen from wallets linked to tampered Ledger devices, according to on-chain researchers cited by CoinDesk. The scale of the losses has prompted Ledger to tighten reseller rules and review protections against physical tampering.
Ledger said in its response to the hardware implant attack on Oct. 15 that it had asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. It also said it was changing how devices are handled in shops and strengthening checks on returned products.
CoinDesk reported that Ledger had confirmed an unauthorized implant in an affected device, while researchers estimated losses across more than 300 wallets. Ledger has not confirmed the total value stolen or the number of victims.
What is Ledger changing in its reseller rules?
Ledger says returned devices must never be resold, even if they appear new and unopened. It has also told authorized sellers to keep products off shelves and displays, store them out of sight and hand them to buyers at the time of purchase.
Resellers must promptly report customer complaints about unusual devices. Ledger said it reminded its network of the existing ban on reselling returns and introduced the new shop-handling steps with immediate effect.
The company also asked resellers and distributors in Southeast Asia and Hong Kong to suspend sales. Ledger said it is working with law enforcement and the security community, and invited other hardware-wallet makers and researchers to share work on tamper detection and chain of custody.
How did the tampered wallets expose recovery phrases?
Ledger says attackers bought genuine devices, opened them, fitted hidden components and returned them to distribution through resellers in Southeast Asia. CoinDesk reported that an implant read the 24-word recovery phrase from the screen during setup and sent it over an LTE mobile connection using an eSIM.
A recovery phrase can be used to recreate a wallet and move its funds. Ledger said the implant did not alter the device’s Secure Element, operating system or transaction signatures, and described the incident as an attack on distribution after the devices left its control.
Ledger said its security team examined devices and screened stock, finding no compromised units in those checks. The investigation is ongoing, including efforts to determine who tampered with the devices and where in the distribution chain it happened.
What should affected Ledger customers do?
Ledger’s guidance reported by CoinDesk distinguishes between unused devices and wallets that have already been set up. If you bought a device from CryptoBilis, the reseller linked to the confirmed losses, the steps are:
- If you have not initialized the device, do not set it up.
- If you have used it, move your assets to a new device with a newly generated recovery phrase.
Ledger said CryptoBilis had stopped selling its hardware wallets. The company has not said when the sales suspension in Southeast Asia and Hong Kong will end, or when it will publish further technical details. It said it plans to share more about the investigation and additional product-level measures when it can.
Sources
- response to the hardware implant attack — ledger.com