Ledger reviews reseller controls after wallet implant attack

Ledger is reviewing how its hardware wallets are sold and how they resist tampering after an unauthorized implant was found in a device sold through reseller CryptoBilis, a case linked to crypto theft estimated above $93 million. Bloomberg Law reported on Oct. 14 that Ledger was reviewing its sales processes and anti-tampering protections, and had asked resellers in Southeast Asia and Hong Kong to suspend sales. The change puts distribution controls in focus alongside the device’s built-in security: a wallet can pass through an authorized sales channel and still be physically altered after leaving the maker.

How much was stolen, and what is confirmed?

Ledger has not published a total loss figure, and blockchain trackers disagree on the scale. Unchained’s report on Ledger’s update and the on-chain estimates said Bitquery tallied $93.2 million across 315 wallets on six blockchains, while YFarmX estimated $103.4 million across 530 addresses on seven. Those are tracker estimates, not a Ledger-confirmed amount.

Ledger said all confirmed cases from the Oct. 9 draining incident involved devices sold through CryptoBilis, a Southeast Asian reseller, and that its direct sales channels and systems were unaffected. It has not said how many devices were compromised. The company told customers not to set up unused CryptoBilis devices; those who had already set one up were advised to move funds to a new recovery phrase on a Ledger device.

How did the implant change the security problem?

Ledger said one affected user’s device contained an unauthorized hardware implant. That finding shifts the immediate question from whether the wallet’s software was genuine to whether its physical custody can be trusted from production through resale. Tom’s Hardware reported that the implant included a cellular module and could capture recovery phrases during initial setup; those technical details have not been independently confirmed by Ledger in the support response reviewed here.

Hardware wallets are designed to keep recovery secrets away from internet-connected computers, but they cannot protect a phrase that is exposed while the user creates it on a physically modified device. Ledger’s standard software authenticity checks also address a different layer of risk than physical inspection and reseller handling. The incident therefore tests the chain between manufacturer and buyer, not just the wallet’s firmware.

What is Ledger changing, and what should buyers watch?

Ledger says it is reviewing controls for direct sales and resellers, advancing hardware protections, and cooperating with authorities. It has also reminded authorized sellers to source only through approved channels and never restock returned products. Suspending sales in some reseller markets can limit exposure while checks are under way, but it also narrows access to devices through local sellers; direct purchase does not resolve what happened to products already distributed.

The next useful signals are whether Ledger publishes the scope of affected devices, explains what checks it will add to reseller and return flows, and reports whether investigators find implants beyond CryptoBilis. The current evidence supports a bounded conclusion: Ledger has confirmed an implant in one affected device and says confirmed drains trace to one reseller, while loss totals remain third-party estimates. How its review changes custody controls—and whether the confirmed scope grows—will determine whether this remains a reseller incident or points to a wider weakness in hardware-wallet distribution.

Source material

• Unchained’s report on Ledger’s update and the on-chain estimates — unchainedcrypto.com