Skip to main content
Uruguay Can

News from across crypto

Ledger reviews reseller controls after wallet implant theft

Ledger is reviewing direct sales, reseller controls and device tamper protections after an implant attack tied to an estimated $90 million in crypto theft.

Uruguay Can Editorial

Ledger reviews reseller controls after wallet implant theft

Ledger is reviewing how it sells and protects its hardware wallets after a device implant was linked to an estimated $90 million in stolen cryptocurrency. Before the incident, customers could buy Ledger devices directly or through authorized resellers.

Ledger CEO Pascal Gauthier said the company is reviewing controls for both sales channels, while Chief Technology Officer Charles Guillemet said it is assessing anti-tampering protections, according to Bloomberg’s report published by Moneyweb. Ledger has asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales, and its response to the hardware implant attack says the affected devices were tampered with after leaving Ledger’s control.

How did the implant put wallet funds at risk?

Ledger says criminals fitted hidden components into genuine devices sold through resellers in Southeast Asia. The components captured users’ recovery phrases during setup, when the words appeared on the device screen. A recovery phrase can restore access to a wallet, so anyone who obtains it may be able to access the funds.

Ledger’s Donjon security team said the implant read the phrase and sent it over LTE through an eSIM. It did not alter Ledger’s Secure Element or operating system, according to The Block’s report on Ledger’s findings. That distinction matters: a device could pass the software’s authenticity check while still containing a separate physical component.

What has Ledger confirmed about the losses?

Ledger has confirmed finding an unauthorized implant in an affected device, but the total loss remains an estimate. Galaxy Digital put the theft at roughly $91 million; other trackers cited by The Block estimated more than $86 million, and Ledger said the total and number of affected users were unverified.

Ledger says its systems and direct sales channels were not compromised. Its immediate response includes two steps:

  1. Ask authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales.
  2. Review sales controls and device protections against physical tampering.

For you, the case shows the gap between checking whether a wallet is genuine and knowing whether it was physically altered before it reached you. Ledger says it will share more findings when it can.

Sources