Ledger, the leading French manufacturer of hardware wallets for cryptocurrencies, has enforced stricter rules on sales channels after discovering that modified Ledger devices were used in a large-scale theft. The move comes as investigators report that more than $100 million in assets was stolen from user wallets by criminals who inserted hidden components into genuine devices before resale.
Modified hardware wallets enable theft
Attackers reportedly purchased authentic Ledger wallets, secretly added illicit hardware to them, and returned these compromised products to resellers, particularly in Southeast Asia. This alteration enabled the devices to capture sensitive customer information during setup.
The scheme was first flagged on October 9, when several customers noticed missing cryptocurrency from wallets bought via the Malaysian retailer CryptoBilis. Following these reports, CryptoBilis suspended wallet sales while an investigation was launched into the incidents.
Ledger reported that perpetrators spent months preparing the attack by buying back legitimate devices, installing covert components, and distributing them through regional sales partners. Secretly altered devices enabled the theft of users’ private recovery phrases and access to their funds.
How the implants compromised wallets
Ledger’s security team identified a hidden implant inside the tampered wallets. This component copied the 24-word recovery phrase that appears during wallet setup—information critical to accessing and transferring cryptocurrencies on the device. The implant then transmitted the recovery phrase through a built-in electronic SIM card and mobile data connection.
Despite these modifications, the primary security chip and Ledger’s operating system reportedly remained unaffected. Former Binance CEO Changpeng Zhao commented on X, stating there was no evidence of widespread vulnerability and that the attack appeared limited to items sold via specific resellers.
Mini dictionary: CryptoBilis — A Malaysian retailer that sells hardware wallets and cryptocurrency accessories, mainly in the Southeast Asian market.
Rising loss estimates and fund tracing
Initial analysis by blockchain researcher Specter estimated losses at over $86 million. However, Bitquery later traced stolen funds totaling $102 million from 324 wallets spread across six different blockchain networks. These figures represent one of the largest recorded hardware wallet breaches in the cryptocurrency space.
| Analyst/Source | Estimated Loss | Wallets Impacted | Date |
|---|---|---|---|
| Specter | $86 million | Not specified | October 2023 |
| Bitquery | $102 million | 324 | October 2023 |
Bitquery also reported that Tether froze $10 million in USDT associated with the stolen funds. The investigation continues to follow the flow of unauthorized transfers, noting that the wallet count may not exactly match the number of individuals affected, as some users controlled multiple addresses.
Bitquery emphasized that while 324 wallets were compromised, the number of impacted customers may be smaller due to multiple wallet ownership. They tracked the proceeds of the crime as they moved through swaps and privacy services on the blockchain.
Ledger’s new rules for retailers and users
In response, Ledger has mandated that authorized dealers keep wallet devices off open display and not resell any returned devices. The company’s internal inspections in Germany and other warehouses found no tampering in on-hand device samples, but sales pauses were enacted in seven regional markets, including Hong Kong, while reviews continued.
Ledger is advising all customers who purchased through CryptoBilis to avoid using uninitialized wallets, and those who already used such devices to immediately transfer assets to a new wallet generated with a fresh recovery phrase. These measures aim to prevent further asset losses as the investigation unfolds.
