Ledger reviews wallet sales after $90 million theft

Ledger is reviewing how it sells and protects its hardware wallets after modified devices linked to about $90 million in crypto theft exposed users’ recovery phrases. Bloomberg reported the sales-policy review on October 14, after Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales.

The figure is an estimate, and Ledger has said the investigation is ongoing. The company’s review covers its sales processes and anti-tampering protections, according to Bloomberg.

How did the altered wallets steal recovery phrases?

A small hardware implant inside some wallets captured the 24-word recovery phrase and sent it over a mobile network. BleepingComputer reported that Ledger’s security team described an implant that decoded the phrase and transmitted it over LTE using an eSIM.

The recovery phrase can give someone access to the crypto held in a wallet. The implant was a separate component, so it did not need to change Ledger’s operating system or security chip. BleepingComputer reported that this meant the company’s usual integrity checks could not detect it.

Which sales are affected by the halt?

Ledger asked distributors in Southeast Asia and Hong Kong to stop sales while it investigates. The halt covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, BleepingComputer reported.

Ledger has linked all confirmed losses to devices sold through CryptoBilis, a reseller operating in the region. The company began investigating user reports on October 9 and asked CryptoBilis to stop selling and shipping its devices. The broader sales pause followed reports of tampered devices from other sellers, though Ledger said confirmed losses remained tied to CryptoBilis.

Ledger has said its own systems and direct sales channel remain safe to use. For buyers, the incident shows how a device can pass a software check while a separate physical component puts the recovery phrase at risk.

What should you watch for next?

Ledger has not announced a date for completing its review. Watch for the company’s next update on reseller checks and anti-tamper protections, and whether it gives buyers a clear way to assess devices already purchased through third parties.

Source material

• reported the sales-policy review — news.bloomberglaw.com
• reported that Ledger’s security team described — bleepingcomputer.com