Ledger halts reseller sales as it reviews wallet tamper controls

New Ledger sales through resellers in Southeast Asia and Hong Kong are on hold while the company reviews how devices reach buyers and how they are protected against tampering. The review follows an attack involving implanted hardware that exposed wallet recovery phrases and led to an estimated $90 million in cryptocurrency theft, according to Bloomberg Law’s report.

For buyers, the immediate change is that resellers in those markets have been asked to stop selling while Ledger investigates. Ledger has not announced a new purchasing process or a timetable for resuming sales.

Which Ledger sales are affected?

Ledger asked resellers and distributors in Southeast Asia and Hong Kong to halt sales and remove products from shelves, BleepingComputer reported. The pause covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong while the investigation continues.

Ledger’s investigation began on October 9 after users reported losses. The company confirmed that some devices sold by CryptoBilis, a reseller in Southeast Asia, had been tampered with. Ledger says all confirmed fund losses involve devices sold through CryptoBilis; separate reports of altered devices from other sellers have not been confirmed as theft cases.

How did an implanted device expose the recovery phrase?

Ledger’s security team said the implant could detect and decode the 24-word recovery phrase entered when a user sets up or restores a wallet, then send it over LTE using an eSIM. That phrase can be used to access the assets protected by the wallet.

The implant was a separate component: it did not change the device’s Secure Element, operating system, transactions or signatures. BleepingComputer reported that this also meant Ledger’s integrity self-checks did not detect it. The incident shows a limit of checking a wallet’s software integrity when the device may have been altered physically before reaching its buyer.

What has Ledger said users should do?

Ledger says its infrastructure, services and direct sales channel remain safe to use, while the reseller pause applies to the named markets. The company has also asked users who suspect their device was tampered with to consult its guidance on safely opening the hardware, as Bloomberg reported. That guidance is for inspection; it does not change the sales pause or establish that a suspected device was involved in a confirmed theft.

The reported theft estimate is not a confirmed total: Bloomberg described it as about $90 million, while Ledger’s response and the sales pause focus on the investigation and affected devices. For now, buyers considering a device from a paused market should wait for Ledger’s update on sales and its review of reseller and anti-tampering controls.

Source material

• Bloomberg Law’s report — news.bloomberglaw.com
• BleepingComputer reported — bleepingcomputer.com