Skip to main content
Blockfront

Crypto markets, protocols and policy

Ledger reviews sales controls after $93 million wallet theft

Ledger is reviewing sales and anti-tampering controls after modified wallets tied to reseller CryptoBilis helped drain an estimated $93 million in crypto.

Blockfront Editorial

2 min read

Ledger reviews sales controls after $93 million wallet theft

Ledger said on Oct. 13 it is reviewing sales and anti-tampering controls after an attack involving modified wallets led to an estimated $93 million in crypto theft, according to Tom’s Hardware’s report on the company’s response. Ledger CEO Pascal Gauthier said the review covers controls for direct sales and resellers.

Ledger also asked distributors and resellers in Southeast Asia and Hong Kong to halt sales and remove devices from shelves while it investigates, BleepingComputer reported on Oct. 14. The company said all confirmed losses involved devices sold through CryptoBilis, a Southeast Asian reseller.

How did the modified wallets steal recovery phrases?

Ledger’s investigation began Oct. 9 after users reported drained wallets. BleepingComputer reported that Ledger found an unauthorized implant in some CryptoBilis devices. The implant’s microcontroller decoded the 24-word recovery phrase and sent it over LTE using an eSIM.

The implant was a separate component: it did not alter Ledger’s Secure Element or operating system, according to the company’s security team as reported by BleepingComputer. That meant it could evade Ledger’s integrity self-checks. A stolen recovery phrase can give an attacker access to the crypto secured by that wallet.

Which sales are affected, and what happens next?

Ledger said its direct sales channel and internal systems were not compromised, BleepingComputer reported. The company ordered distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales until its device safety investigations are complete.

Gauthier said Ledger would share what it can about the review, according to Tom’s Hardware. Ledger has not announced a timeline for completing the review or detailed changes to its reseller and anti-tampering policies.

Sources and documents