Ledger to review reseller controls after $93 million wallet theft

Ledger says it will review how its hardware wallets are sold and protected against tampering after devices linked to reseller CryptoBilis were used in crypto thefts. Bloomberg put the reported losses at $93 million, according to Tom’s Hardware’s report on Ledger’s planned review.

What is Ledger reviewing?

Ledger CEO Pascal Gauthier said the company is reviewing controls for direct sales and resellers, and will share what it can. Tom’s Hardware reported that Ledger is also reviewing anti-tampering protection on its devices and its chain-of-custody practices, which track how products move through the supply chain.

Ledger has asked resellers and distributors in Southeast Asia and Hong Kong to suspend sales while it investigates, according to BleepingComputer’s report on the sales halt. The company also told distributors to use authorized supply channels and not restock returned devices, BleepingComputer reported.

How were the affected wallets altered?

Ledger confirmed that at least one device bought through CryptoBilis contained an unauthorized hardware implant. BleepingComputer reported that Ledger’s security team later described how the implant could detect a wallet’s 24-word recovery phrase, which lets its owner restore access, and send it over a mobile connection.

The implant was a separate component. It did not change Ledger’s operating system or the device’s security chip, according to BleepingComputer. That meant the company’s usual device checks could not detect it.

What is known about the thefts?

Ledger opened an investigation on October 9 after users reported losing funds. The company said all confirmed losses involved devices sold by CryptoBilis, BleepingComputer reported. It has not said how or when the devices were altered.

Tom’s Hardware reported that Ledger advised people with tampered devices to contact support for instructions to send them in for examination. The company has also invited researchers and other vendors to help assess its controls. The reported losses show why the route a wallet takes from seller to customer can matter as much as checks built into the device.

Sources and documents

• Tom’s Hardware’s report on Ledger’s planned review — tomshardware.com
• BleepingComputer’s report on the sales halt — bleepingcomputer.com