Ledger Reviews Wallet Sales After $90 Million Crypto Theft

Ledger is reviewing how its hardware wallets are sold after hidden components installed in some devices helped attackers steal an estimated $90 million in cryptocurrency, according to Bloomberg’s report on the incident. The theft targeted the route a device took to a buyer: attackers could capture a wallet’s recovery phrase before the owner used the device to secure funds.

How did an implant get into a Ledger wallet?

Ledger says criminals bought genuine devices, opened them, fitted hidden components designed to capture recovery phrases during setup, then returned the devices to distribution through resellers in Southeast Asia. The devices had already left Ledger’s control. The company describes the incident as an attack on that distribution channel, rather than a breach of its chip, operating system or servers.

The distinction matters because a hardware wallet stores the keys used to approve crypto transactions, while its recovery phrase can restore access to those keys. A device can be genuine and still be physically modified after it leaves the manufacturer. Ledger said its investigation found an unauthorized implant in an affected user’s device; its public response does not provide a confirmed count of compromised units.

How did the hidden component lead to stolen funds?

During initial setup, a user generates or verifies a recovery phrase, typically a sequence of 24 words. Ledger says the hidden components were designed to capture that phrase. Once attackers had it, they could use it to gain access to the associated wallet and move its cryptocurrency. The sequence was: modify the device, capture the phrase during setup, then use the phrase to drain funds.

Ledger’s explanation identifies the recovery phrase as the point of exposure. It has not described every technical step between capturing the phrase and the transfers, so the full route from implant to each stolen asset remains under investigation. The company says its own systems and direct sales channels were unaffected.

What is Ledger changing in its sales process?

Ledger asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong while it investigates. It is reviewing reseller controls, hardware protections and the way devices are tracked from source to buyer, according to Ledger’s response to the hardware implant attack. The company also told distributors to use authorized supply channels and not to restock returned devices.

The immediate change is a pause in regional reseller sales and a review of how devices are handled after leaving Ledger. The next details to watch are the findings of the investigation and any further changes to reseller checks or tamper detection.

References

• Bloomberg’s report on the incident — news.bloomberglaw.com
• Ledger’s response to the hardware implant attack — support.ledger.com