Ledger reviews wallet sales after CryptoBilis-linked theft
Ledger is reviewing reseller controls after an implanted hardware component in wallets sold through CryptoBilis was linked to about $90 million in crypto theft.
The Finality Desk3 min read#98af6a
Ledger is reviewing how its hardware wallets reach customers after an attack linked to reseller CryptoBilis led to an estimated $90 million in cryptocurrency theft. Bloomberg reported Ledger’s review of its sales policies and processes on Oct. 14, after the company asked resellers in Southeast Asia and Hong Kong to suspend sales of its devices.
The incident was first reported on Oct. 9, when customers said funds had been drained from wallets bought through CryptoBilis. Ledger later confirmed finding an unauthorized hardware implant in one affected device. The reported theft is a supply-chain attack: a modified device can expose the recovery phrase that gives control of a wallet, even if the wallet’s software and the manufacturer’s own sales systems were not breached.
How could an implant expose a wallet’s recovery phrase?
A hardware wallet displays its recovery phrase during initial setup, when the owner creates or restores a wallet. Tom’s Hardware reported that the implant used a cellular or LTE module to capture the phrase during setup and send it to the attackers.
The phrase is the critical secret in this path. Whoever obtains it can restore the wallet on another device and sign transactions controlling its assets. The attacker does not need to extract a key from the wallet’s secure hardware or compromise the computer connected to it if the phrase itself is exposed.
Tom’s Hardware reported that the implant could read the data lines carrying the phrase or capture the device’s display output, then transmit it over LTE. It also reported that the modification sat outside the chip running Ledger’s firmware, allowing it to evade Ledger’s software-based Genuine Check. Ledger has confirmed an unauthorized implant in one affected device; the precise route used to compromise every stolen wallet has not been established publicly.
What is Ledger reviewing after the CryptoBilis incident?
Ledger is assessing its anti-tampering protections and controls on both direct sales and resellers. CEO Pascal Gauthier said the company would review those controls, according to Tom’s Hardware. Ledger also asked resellers in Southeast Asia and Hong Kong to suspend sales while its investigation continued, Bloomberg reported.
The failure point described in the reporting is the device’s physical chain of custody. A firmware check can verify aspects of the device’s software and connection, but an implant operating outside the firmware may not be visible to that check. Reseller and distribution controls therefore matter alongside software validation: a device can arrive in packaging that appears intact while containing unauthorized hardware.
What is confirmed about the scale and scope?
Bloomberg put the estimated theft at about $90 million. Tom’s Hardware reported a figure of $93 million and said the devices were physically tampered with in the supply chain. These are reported estimates; Ledger has not publicly confirmed a final loss total or the number of affected customers.
Ledger’s confirmation of an implant in one affected device establishes that physical tampering occurred. It does not establish that every wallet involved was compromised in the same way, or that Ledger’s firmware or direct-to-consumer sales channel was breached. That distinction matters because a hardware implant that captures a recovery phrase during setup creates a different failure path from a vulnerability in wallet firmware: the attacker takes control of the recovery secret before the device can protect it.