Ledger reviews wallet sales after $93M theft
Ledger will review how it sells and protects its hardware wallets after a reseller-linked implant attack was tied to an estimated $93 million in crypto theft.
Crypto Daybook Newsroom2 min read
Ledger says it will review how it sells its hardware wallets and protects them against tampering after an attack linked to an estimated $93 million in crypto theft. The company’s CEO said it would review controls for direct sales and resellers, according to Tom’s Hardware’s report.
How did the tampered wallets steal crypto?
The attack involved a hidden hardware implant in a Ledger wallet sold through the CryptoBilis reseller, Ledger said in its response to the hardware implant attack. Tom’s Hardware reported that the theft was first noticed on Oct. 9, when hundreds of wallets were drained across Bitcoin, Ethereum and Tron. The $93 million estimate came from a Bloomberg report cited by Tom’s Hardware.
According to Tom’s Hardware, investigators found a cellular chip inside an affected device. It could read the 24-word recovery phrase—the secret words used to restore a wallet—during setup, then send it over a mobile network. Someone with that phrase can access the funds in the wallet. The implant was outside the chip running Ledger’s firmware, so the device’s automated “Genuine Check” did not detect it, the report said.
What is Ledger changing?
Ledger CEO Pascal Gauthier said the company would review controls for its own sales and reseller sales. The company also plans to review its anti-tampering protections and invite researchers and other vendors to assess them, according to Tom’s Hardware.
Ledger told CryptoBilis to halt sales and shipments. It also said its internal systems, firmware and direct sales channels were unaffected. The company advised customers with wallets bought from third-party resellers to move funds to another wallet using a newly generated recovery phrase while it investigates.
What should affected customers do?
Ledger said customers with a device they believe was tampered with should contact its support team. The company can provide shipping instructions for further examination. Tom’s Hardware also reported that Ledger advised customers who want to inspect a device themselves to follow its safety guidelines.
The case shows how a wallet can be altered before it reaches its owner. A hardware wallet keeps the keys to crypto offline during normal use, but that protection depends on the device and its supply chain being secure. Ledger has not said when its policy review will be complete.
References
- Tom’s Hardware’s report — tomshardware.com
- response to the hardware implant attack — support.ledger.com