TLDR
- Ledger introduces tighter sales controls following the discovery of modified hardware wallets sold through resellers.
- Criminals installed hidden components that captured customers’ 24-word recovery phrases and transmitted them through mobile networks.
- Bitquery estimates $102 million was stolen from 324 wallets, exceeding Specter’s earlier $86 million estimate.
- Ledger says inspections found no tampering in the retail and warehouse samples its teams examined.
- Authorized dealers must keep devices off display shelves, while returned wallets remain barred from resale.
Ledger has introduced tougher rules for hardware wallet sellers after criminals altered genuine devices and stole cryptocurrency. In its October 15 statement, the company reaffirmed its ban on reselling returned wallets and ordered retailers to keep new devices away from display shelves.
Criminals altered devices before resale
Ledger said attackers purchased legitimate wallets, fitted hidden components, and returned them to reseller channels in Southeast Asia. The company said the group spent months preparing the operation and built systems to collect recovery phrases and move stolen funds.
The investigation began on October 9 after customers reported missing assets from devices sold by Malaysia-based CryptoBilis. An earlier Ledger wallet theft investigation connected the complaints to the reseller, which subsequently halted sales.
How the hidden implants worked
Ledger’s security team found an implant that copied the 24-word recovery phrase displayed during wallet setup. The component then sent those words through a mobile data connection using a built-in electronic SIM card.
The company said the device’s security chip and operating system remained intact. Binance founder Changpeng Zhao warned on X on October 9 that the evidence pointed to an attack through one seller, rather than a problem across all Ledger wallets.
Loss estimates rise as investigators trace funds
Blockchain researcher Specter initially estimated losses above $86 million. However, Bitquery’s October 15 update traced $102 million from 324 wallets across six networks. Earlier confirmation of device tampering established that investigators found an unauthorized component. Ledger has not confirmed total losses or the number of affected customers.
Bitquery said Tether froze $10 million in USDT linked to the theft. Its investigation also tracked stolen funds through swaps and privacy services. The researchers counted wallets, not individual customers, and noted that one owner could control several affected addresses.
Ledger changes distribution and customer guidance
Ledger said its teams examined devices from stores in Germany and stock held in warehouses. Those samples showed no tampering. In an October 14 X update, the company called for a pause in sales across seven markets, including Hong Kong. Resellers in Asia suspended wallet sales as the investigation continued.
Authorized dealers must now store wallets away from public shelves and hand them to buyers at purchase. Ledger advises CryptoBilis customers against setting up unused devices. Those who already used one should move assets to a new wallet with a fresh recovery phrase.
The post Ledger Reveals How Hidden Chips Exposed Crypto Wallets appeared first on Blockonomi.
