Ledger reviews reseller controls after wallet implant theft

Ledger is reviewing how its hardware wallets reach customers and how devices are checked for tampering after an attack involving altered reseller-sold devices led to an estimated $90 million in stolen cryptocurrency. Bloomberg’s report says Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales; Chief Technology Officer Charles Guillemet separately said the company is assessing its anti-tampering protections.

The loss figure varies by report: Bloomberg put it at an estimated $90 million, while Tom’s Hardware reported $93 million. The reported failure was physical access during distribution, rather than a break in the wallet’s signing cryptography. That distinction matters because a hardware wallet can protect private keys during transaction signing and still fail if an attacker captures the recovery phrase used to restore those keys.

How did an implant expose recovery phrases?

Ledger’s account describes criminals buying genuine devices, opening them, installing hidden components designed to capture recovery phrases during setup, then returning the devices to distribution through resellers. A recovery phrase is entered or displayed when a user initializes a wallet; whoever obtains it can recreate the wallet’s keys on another device and authorize transfers.

Tom’s Hardware reported that an affected device contained an unauthorized implant with a cellular/LTE module. It said the component captured the phrase as it appeared on the device’s OLED display or traveled over internal data lines, then transmitted it over LTE. The report also said the implant sat outside the chip running Ledger’s firmware, so Ledger’s software-based “Genuine Check” did not detect that physical modification. These are reported findings about the attack; Ledger’s public description confirms hidden components designed to capture the phrase but does not establish that every affected device used the same capture or transmission method.

What is Ledger changing, and what is known about scope?

Ledger CEO Pascal Gauthier said the company is reviewing controls for direct sales and resellers, according to Tom’s Hardware. Bloomberg reported that resellers were told to suspend sales in Southeast Asia and Hong Kong. Ledger’s response page characterizes the incident as a localized distribution-channel attack after the affected devices had left the company’s control, and says its chip, operating system and servers were not compromised.

Ledger has not announced a new anti-tamper design, a deadline for the review or a completed policy change. Its current response therefore consists of a sales suspension in specified markets and a review of sales and device protections. The review must address two distinct checks: who handles each device between Ledger and the buyer, and whether a device can reveal physical interference before a user enters a recovery phrase. A firmware authenticity check can establish that software is genuine while leaving a post-sale hardware implant outside its view.

What should owners of reseller-sold devices do?

Ledger’s CTO asked users who suspect their devices were altered to contact support for shipping instructions and to consult Ledger’s guidance before opening a device themselves. The company says it is investigating and reviewing its controls; the reports do not establish that all reseller devices, or all Ledger wallets, were affected. The key exposure is the recovery phrase: once captured, it can allow an attacker to recreate the wallet independently of the original hardware.

References

• Bloomberg’s report — news.bloomberglaw.com
• Tom’s Hardware reported $93 million — tomshardware.com