Skip to main content
BitCurrent

Crypto markets, protocols and policy

Ledger tightens reseller rules after $90 million wallet theft

Ledger is tightening reseller rules after an implant was found in wallets linked to an estimated $90 million theft, though the full losses remain unconfirmed.

BitCurrent Newsroom2 min read

Ledger tightens reseller rules after $90 million wallet theft

Hardware wallets are designed to keep crypto keys offline. Ledger is reviewing how its devices reach buyers after an implant in some wallets was linked to an estimated $90 million theft.

  • Estimated stolen crypto: $90 million, according to Bloomberg.
  • Ledger’s response: Oct. 15, 2026.

Bloomberg’s report said Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales and was assessing its anti-tampering protections. The company’s own account confirms the reseller pause and sets out new handling rules.

How did the implant reach customers?

Ledger said a criminal group bought genuine devices, opened them and fitted hidden components designed to capture recovery phrases during setup. The devices then returned to distribution through resellers in Southeast Asia.

A recovery phrase can restore access to a wallet. Ledger said its chip, operating system and servers were not compromised; the attack took place after devices left its control.

What is Ledger changing for resellers?

In its Oct. 15 response, Ledger said returned devices must never be resold, even if they appear unopened. It also told authorized resellers to keep stock off shelves and displays, hand devices to customers at purchase, and report unusual products promptly.

The company said it screened samples from its own stock and examined devices from stores and warehouses. It reported finding no compromised units in those checks. Ledger is working with law enforcement and the security community to trace funds and investigate the attackers’ infrastructure.

How much crypto was taken?

Bloomberg put the stolen cryptocurrency at an estimated $90 million. Ledger’s Oct. 15 statement did not give a total, so the final loss figure remains open.

The full technical account is also pending. Ledger said it plans to share more details and is developing additional product-level measures against similar attacks.

Source material