Ledger reviews reseller controls after wallet implant thefts

Ledger is reviewing how its hardware wallets are sold and protected against tampering after implanted devices were linked to an estimated $90 million in stolen cryptocurrency. The review widens the security question from whether a wallet’s software and secure element are sound to whether the device stayed intact while passing through distributors and resellers. Bloomberg Law’s report says Ledger is assessing its sales processes and anti-tampering protections.

Ledger asked resellers and distributors in Southeast Asia and Hong Kong to suspend sales while it investigates. The response follows reports of tampered devices sold through CryptoBilis, a Southeast Asian reseller. Ledger’s investigation began on October 9, according to BleepingComputer, which reports that all confirmed fund losses involved devices sold by CryptoBilis.

How did the implant get around Ledger’s checks?

The implant was a separate component that captured recovery phrases during setup and sent them over LTE, BleepingComputer reported. Ledger’s Donjon security team said the component’s microcontroller detects and decodes the 24-word recovery phrase, then transmits it using a provisioned eSIM. Because it did not alter the device’s Secure Element, operating system, transactions or signatures, it could evade Ledger’s integrity self-checks.

That distinction matters because a hardware wallet is designed to keep private keys isolated while users approve transactions on the device. In this attack, the reported route to funds was the recovery phrase entered during setup: once obtained, it could give an attacker access to the wallet’s assets. Software checks can help establish that a device is running expected code, but they cannot by themselves establish that no separate hardware was added elsewhere in the distribution chain.

How wide is Ledger’s sales response?

The pause applies to distributors in six Southeast Asian countries—Indonesia, Singapore, Thailand, the Philippines, Vietnam and Malaysia—and Hong Kong, BleepingComputer reported. Ledger said its infrastructure, services and direct sales channel were safe to use. The halt is therefore a regional distribution measure while the company investigates, rather than a reported shutdown of all Ledger sales.

There is also a limit to what the confirmed cases establish: Ledger has tied confirmed fund losses to CryptoBilis devices, while users have reported suspect devices bought from other sellers in Asia and Europe. Those reports prompted concern, but they do not establish that those other purchases caused confirmed losses. The difference between reports of modified devices and confirmed thefts will shape how broadly Ledger needs to change its controls.

What could change for buyers and other wallet makers?

Ledger’s review points to a trade-off between broad retail availability and tighter control over how products are sourced, stored and handled. Direct sales reduce the number of intermediaries, while authorized resellers make devices more accessible across markets. Trezor, a competing hardware-wallet maker, said it plans to reduce its reseller network and strengthen partner checks; it said it had found no evidence that its devices were compromised, according to BleepingComputer. That is a separate precaution, not evidence of a similar attack.

The next signals are whether Ledger publishes specific changes to reseller oversight and anti-tamper protections, whether investigators confirm additional losses beyond CryptoBilis, and whether the sales pause is lifted after device checks. Those details will show whether the response remains a regional halt or changes how Ledger handles distribution across its wider retail network.

Source material

• Bloomberg Law’s report — news.bloomberglaw.com
• BleepingComputer — bleepingcomputer.com