Ledger reviews reseller controls after $93 million wallet theft

Ledger said on Oct. 13 it would review its direct-sales and reseller controls after a hardware implant attack linked to CryptoBilis was tied to an estimated $93 million in crypto theft. The loss estimate includes trackers’ counts across networks; Galaxy Research counted about $91 million. Ledger’s response to the hardware implant attack says confirmed cases so far involve devices sold through the Southeast Asian reseller.

• About $91 million traced by Galaxy Research across 474 addresses.
• Trackers that also count BNB Chain put losses at $93 million to $95 million.
• Ledger said confirmed cases involved CryptoBilis devices.

Ledger CEO Pascal Gauthier said the company was reviewing controls for both direct sales and resellers. CTO Charles Guillemet said Ledger was also examining its anti-tampering measures, according to Quartz’s report on Ledger’s reseller review.

How did the implant take funds from wallets?

Ledger confirmed that at least one affected device contained an unauthorized hardware implant. The separate component read the device’s display during setup, captured the 24-word recovery phrase and sent it over an LTE connection using an embedded SIM, Galaxy Research reported.

A recovery phrase is the set of words used to restore access to a crypto wallet. Anyone who obtains it can use it to control the wallet’s funds. The implant left Ledger’s Secure Element and operating system untouched, so the company’s Genuine Check could still pass on a modified device.

Galaxy’s on-chain analysis found about $91 million moved from 474 addresses across Bitcoin, Ethereum, Arbitrum, Polygon and TRON. Trackers that include BNB Chain estimated a higher total, between $93 million and $95 million. The difference reflects which networks are counted.

What is Ledger changing, and what should buyers know?

Ledger asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong while it investigates. It also told its distributors to source products through approved channels and not to restock returned units, according to the company’s response.

Gauthier said Ledger would share what it could about the review. The company has described the affected volume as “limited,” but has not published a total number of affected devices or users. Galaxy Research said every confirmed case it reviewed involved a device sold through CryptoBilis, which suspended hardware sales.

Ledger said its own systems and direct sales channels were not compromised. That does not rule out risk for devices bought through resellers: the implant sat outside the components checked by Genuine Check. Ledger advises people who suspect their device was tampered with to contact support for instructions and to follow its inspection guidance.

Does the review establish the full scale of the attack?

No. Ledger is still investigating, and the company has not confirmed the total losses or the full number of affected users. The $93 million figure is an estimate from trackers, while Galaxy Research’s separate analysis counted about $91 million across five networks.

The confirmed findings point to a physical attack during distribution, rather than a breach of Ledger’s firmware or direct-sales systems. Ledger’s review now covers how devices reach buyers and how the company detects physical modifications. Until it publishes more findings, the scope remains uncertain.

Sources and documents

• response to the hardware implant attack — support.ledger.com
• Quartz’s report on Ledger’s reseller review — qz.com