Skip to main content
Blockfront

Crypto markets, protocols and policy

Ledger Reviews Wallet Sales After $90 Million Crypto Theft

Ledger halted reseller sales across Southeast Asia and Hong Kong after implanted wallets exposed recovery phrases, prompting a review of its sales and anti-tampering controls.

Blockfront Editorial

2 min read

Ledger Reviews Wallet Sales After $90 Million Crypto Theft

Ledger told resellers in Southeast Asia and Hong Kong to suspend device sales on Oct. 13 and is reviewing how its wallets reach consumers after implanted devices were linked to an estimated $90 million in stolen cryptocurrency, Bloomberg reported.

The company is also assessing its anti-tampering protections, Bloomberg reported, citing Ledger Chief Technology Officer Charles Guillemet. Ledger’s incident update says the attack targeted devices after they left Ledger’s control and describes new reseller procedures, including keeping products off display until purchase.

How did the implanted wallets expose users’ funds?

Ledger said devices sold through Southeast Asian reseller CryptoBilis contained hidden components that captured recovery phrases during setup. The Record reported that the implant read the 24-word phrase from the device’s screen and sent it over an LTE connection using an embedded eSIM.

Attackers could use the phrase to access victims’ funds. The thefts were first reported on Oct. 9, according to The Record. Ledger has not confirmed the total losses, the outlet reported, while Bloomberg cited an estimate of about $90 million.

Which sales channels has Ledger suspended?

Ledger asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales, according to the company’s incident update. CryptoBilis also paused sales and shipments of Ledger devices while the investigation continues, The Record reported.

Ledger said its chip, operating system and servers were not compromised, and characterized the incident as an attack on the distribution channel. The company is reviewing reseller controls and hardware protections; its incident update says affected customers should contact Ledger Support for guidance.

Sources and documents