Ledger reviews reseller controls after wallet implant theft

Hardware wallets are meant to keep crypto keys offline. Ledger says it is reviewing sales controls and anti-tampering measures after a hidden implant in devices sold through reseller CryptoBilis was linked to stolen funds.

The company said its investigation found an unauthorized component inside an affected device. Ledger’s response to the hardware implant attack says the modified devices were genuine units fitted with hidden parts and returned to distribution through resellers in Southeast Asia.

Tom’s Hardware reported that estimates put losses at about $93 million. Ledger says all confirmed cases tied to the draining incident involved devices sold through CryptoBilis; its own systems and direct sales channels were not affected.

The incident shows that a wallet’s security also depends on how the device is handled before it reaches its owner.

How did the modified wallets expose recovery phrases?

A separate component inside the device read the 24-word recovery phrase shown on the screen during setup, then sent it over LTE using an eSIM, according to Ledger. The implant left the Secure Element and Ledger operating system untouched, so the company’s standard Genuine Check could still pass.

That matters because the recovery phrase can restore access to the wallet elsewhere. Once an attacker has it, the device’s offline storage does not stop them from accessing the associated crypto.

What is Ledger changing after the theft?

Ledger says it is reviewing controls for direct sales and resellers, as well as its anti-tampering protections. The company has asked authorized resellers and distributors to source devices through approved channels and not restock returned units.

It also asked distributors in Southeast Asia and Hong Kong to suspend sales while the investigation continues, according to BleepingComputer’s report on the sales halt. Ledger says it is working with researchers and other vendors on supply-chain and tamper-detection practices.

What should CryptoBilis buyers do now?

Ledger advises buyers who have not yet set up a CryptoBilis device not to initialize it. Anyone who already used one should move funds to a new wallet with a newly generated recovery phrase; contacting Ledger Support through its official site is the route the company recommends for concerns about a potentially affected device.

Those steps take time: moving funds means setting up a separate wallet and transferring assets, while generating a new phrase means keeping a fresh backup secure. Ledger says users should rely on its official support channels and never share their 24-word phrase with someone contacting them.

Sources

• response to the hardware implant attack — support.ledger.com
• BleepingComputer’s report on the sales halt — bleepingcomputer.com