Ledger reviews reseller controls after wallet implant thefts

Ledger is reviewing how its wallets are sold and how they resist tampering after an implant in some reseller-sold devices was used to steal crypto, Bloomberg reported on Oct. 14. The device stores private keys and uses them to sign transactions. In the affected wallets, a separate component reportedly read the 24-word recovery phrase from the screen during setup, then sent it over LTE through an eSIM. That phrase can restore access to the wallet.

BleepingComputer’s report on Ledger’s sales halt says Ledger’s security team found an implant that captures the recovery phrase and transmits it to an unauthorized party. The implant did not alter the Secure Element or Ledger operating system, the report says. Those parts handle key storage and device checks.

How did the implant get around the wallet’s checks?

The implant worked alongside the wallet’s normal components. According to BleepingComputer, it did not change the Secure Element or the wallet’s operating system, so Ledger’s integrity checks did not detect it. The screen became the weak point: the implant read the recovery phrase as the user set up the wallet, then used its cellular connection to send the phrase out. It was like someone copying a house key while watching the owner use it; the lock itself did not need to be broken.

A recovery phrase is different from a transaction signature. The wallet’s Secure Element can still sign transactions correctly, while someone holding the phrase can restore the wallet elsewhere and access its funds. Ledger said confirmed losses involved devices sold by Southeast Asian reseller CryptoBilis. The reseller suspended hardware-wallet sales, according to BleepingComputer.

What is Ledger changing, and how large were the losses?

Ledger asked resellers and distributors in Southeast Asia and Hong Kong to halt sales while it investigates, BleepingComputer reported. Bloomberg said Ledger is reviewing its sales policies and processes, and that Chief Technology Officer Charles Guillemet said the company was assessing its anti-tampering protections.

Researchers put losses near $93 million, but that figure is an estimate rather than a total Ledger has confirmed. Galaxy Research counted roughly $91 million across five networks and said trackers including BNB Chain put the figure at $93 million to $95 million. The counts differ because they cover different networks and addresses.

The review reaches beyond device software. A wallet’s security depends on the hardware and checks inside it, but also on how each unit is handled before it reaches its buyer. Ledger’s sales pause gives the company time to investigate that path. The reports do not yet say what new reseller or anti-tampering rules it will adopt.

Source material

• BleepingComputer’s report on Ledger’s sales halt — bleepingcomputer.com