Skip to main content
BitCurrent

Crypto markets, protocols and policy

Ledger reviews reseller controls after wallet implant theft

Ledger is reviewing reseller sales and anti-tamper controls after an implanted wallet device exposed recovery phrases in a theft estimated at up to $95 million.

BitCurrent Newsroom2 min read

Ledger reviews reseller controls after wallet implant theft

Ledger is reviewing how its hardware wallets reach customers and how devices resist tampering after an implant in a reseller-sold wallet exposed a recovery phrase in a theft estimated at about $90 million. The incident puts the security of distribution channels under scrutiny alongside the devices themselves.

  • Bloomberg reported an estimated $90 million stolen.
  • Galaxy Research counted about $91 million leaving 474 victim addresses.
  • Other trackers that include BNB Chain put losses at $93 million to $95 million, Galaxy said.

Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales while it reviews its policies, according to Bloomberg’s report on the sales review. Chief Technology Officer Charles Guillemet also said the company is assessing anti-tampering protections.

How did the implant expose recovery phrases?

Galaxy Research reported that Ledger confirmed an unauthorized hardware implant in an affected device sold through CryptoBilis, a Southeast Asian reseller. The implant read the device screen during setup, captured the 24-word recovery phrase and sent it over LTE using an eSIM, according to Galaxy’s incident analysis.

That route bypassed the wallet’s Secure Element and operating system, Galaxy said. Ledger’s Genuine Check passed on the tampered device because the implant operated outside those components.

What has Ledger changed so far?

Ledger told CryptoBilis to pause sales and shipments, Galaxy reported. It also said its own systems and direct sales channels were not compromised, and that every confirmed case so far involved a device sold through CryptoBilis.

Those statements narrow the confirmed scope. They do not establish how many devices were modified or how widely they were distributed.

What remains unknown?

The loss totals remain estimates, not a final tally. Galaxy counted about $91 million across Bitcoin, Ethereum, Arbitrum, Polygon and TRON, while trackers covering BNB Chain put the total higher.

Ledger has not yet detailed what changes it will make to reseller oversight or device protections. Its review is ongoing, leaving open how the company will verify products across the sales chain and detect physical modifications.

Source material