Ledger reviews wallet sales after $90 million hack

Ledger said it is reviewing how its hardware wallets are sold and protected after an implant was found in a reseller-sold device and users reported crypto losses. Bloomberg’s Oct. 14 report put the estimated losses at about $90 million. The review matters because the reported attack involved devices altered after they left Ledger’s control.

A recovery phrase is a set of secret words used to restore access to a crypto wallet. Ledger devices are designed to keep the keys that control funds offline, but an altered device can expose the phrase during setup.

How did the implant capture wallet recovery phrases?

Ledger’s Donjon security team said the implant reads the 24-word recovery phrase from the device screen during setup and sends it over a mobile connection. The Block reported that the implant used LTE, a type of cellular network, and an eSIM, a built-in digital SIM card.

The company said the implant did not change the device’s Secure Element, the chip that protects its keys, or its operating system. It also said there was no sign that Ledger’s own systems or services had been compromised. The attack described so far targeted some physical devices sold through a reseller.

What has Ledger confirmed about the losses?

Ledger confirmed finding an unauthorized implant in an affected customer’s device. The Block reported that third-party on-chain estimates — calculations based on public blockchain transactions — put suspected losses above $86 million, while some later estimates reached $93.2 million. Ledger said the total and number of affected users had not been verified.

The figures should therefore be treated as estimates, not a confirmed tally of funds stolen by the implant. Ledger has not established that every reported loss came from a modified device.

What is Ledger changing for wallet sales?

Ledger is reviewing the controls on direct sales and resellers, as well as protections against device tampering, according to Bloomberg. The company had asked resellers in Southeast Asia and Hong Kong to pause sales. It also asked customers who suspect a device was altered to contact support and follow its instructions before opening it.

For buyers, the incident highlights a risk that begins before a wallet reaches its owner: a genuine device can be opened, modified and repackaged while moving through distribution. Ledger has not said when its review will be complete or what sales controls it will change.

References

• Bloomberg’s Oct. 14 report — news.bloomberglaw.com