Ledger reviews wallet sales after $93M crypto theft

Ledger is reviewing how its hardware wallets reach customers and how they resist tampering after devices sold through a reseller were linked to about $90 million in stolen cryptocurrency. Bloomberg Law reported that Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales; Tom’s Hardware put reported losses at $93 million.

Ledger CTO Charles Guillemet said the company is also assessing its anti-tampering protections. The review follows reports that attackers physically modified some devices before they reached buyers, putting users’ recovery phrases at risk.

How did the modified wallets expose recovery phrases?

A hidden cellular chip in an affected device could capture a user’s 24-word recovery phrase during initial setup, according to Tom’s Hardware’s account of the incident. The phrase appeared on the wallet’s screen as the user created or checked it. The implant reportedly recorded the display or read the data lines carrying the phrase, then sent it over an LTE connection.

Someone with the phrase can recreate the wallet’s keys and move its crypto. Tom’s reported that the modification sat outside the chip running Ledger’s firmware, so the company’s automated “Genuine Check” did not detect it. The device could pass that software check while carrying extra hardware.

Which sales channels has Ledger asked to stop?

Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales while the company investigates, Bloomberg reported. Tom’s identified CryptoBilis, an authorized reseller covering Malaysia and Southeast Asia, as the source of almost all affected devices known at the time of its report.

Ledger said its direct sales channels and internal systems were not compromised, according to Tom’s. It also told distributors to use approved supply channels and not to restock or resell returned devices. The company’s review covers its direct sales and reseller controls, CEO Pascal Gauthier said in a post cited by Tom’s.

What should Ledger customers watch for next?

Ledger has not announced a deadline for the review. Guillemet asked people who suspect their wallets were tampered with to contact Ledger Support for instructions on sending devices in for examination. He also pointed users to company guidance for safely opening a device to inspect it.

For you, the next signal is what Ledger publishes about its revised reseller checks and anti-tampering measures, alongside any findings from examining suspect devices. The company has said it will share what it can, but it has not set a date.

Source material

• Bloomberg Law reported — news.bloomberglaw.com
• Tom’s Hardware’s account of the incident — tomshardware.com