Ledger tightens wallet sales rules after $86 million theft estimate

Ledger said on Oct. 15 it is tightening reseller rules after modified hardware wallets captured recovery phrases and wallets were drained; an onchain estimate put losses above $86 million, but the total remains unverified, The Block reported. In its response to the hardware implant attack, Ledger said hidden components were fitted to genuine devices and returned to distribution through Southeast Asian resellers.

What changes will Ledger make to wallet sales?

Ledger told authorized resellers and distributors that returned devices must never be resold, even if they appear unopened. The company also said products should no longer be placed on shelves or displays; stores should keep stock in the back and hand devices to customers at purchase.

Resellers must promptly report customer complaints about unusual products, Ledger said. It asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong while it investigates.

How did the tampered wallets expose recovery phrases?

Ledger said attackers bought genuine devices over several months, opened them, installed hidden components designed to capture recovery phrases during setup, then put the devices back into distribution. The company said the attack targeted devices after they left its control and that its chip, operating system and servers were not compromised.

The Block reported that Ledger’s Donjon security team found an implant that captured the 24-word phrase from the device screen and sent it over LTE through an eSIM. Ledger said it is working with law enforcement and the security community to trace funds and dismantle the attackers’ infrastructure.

What is known about the reported losses?

The Block said onchain researchers estimated losses above $86 million across Bitcoin, Ethereum and Tron, but Ledger had not verified the total or the number of affected users. Ledger said it examined devices and warehouse samples without finding further compromised units.

Ledger said it plans to publish more details and share technical findings with industry peers when it can. It also said it is working on additional product-level measures against this kind of attack.

Sources and documents

• The Block reported — theblock.co
• response to the hardware implant attack — ledger.com