Ledger wallets sold by a reseller were tampered with
Ledger has confirmed that a device bought through an unauthorised reseller contained a hardware implant. Here's what's confirmed, what isn't, and what to do if you own one.
What happened
Ledger says some hardware wallets sold through CryptoBilis, a reseller in Southeast Asia, were compromised with a hardware implant. Ledger confirmed that at least one impacted user's device contained an unauthorised implant.
Ledger said reports of unexpected fund drains were all linked to devices sold through CryptoBilis. On 9 October it asked CryptoBilis to stop selling and shipping Ledger devices.
How the implant reportedly worked
A user who shared details of their own drained wallet said the implant captured the device's display output and button presses, which could reveal the recovery phrase. It then sent that information to the attacker over a mobile connection. Security researchers reported two implant variants in Ledger X devices. One replaced the original battery. The other sat where the display's foam padding normally goes.
What we know
- Ledger has confirmed at least one device was tampered with.
- The devices were sold through CryptoBilis, which Ledger has asked to stop selling Ledger products.
- Ledger describes the affected volume as "limited".
What we don't know yet
No total loss figure has been confirmed by Ledger. Some reports quote large numbers, but we haven't verified them, so we're not publishing one.
Ledger hasn't said how many devices were affected, or how or when they were tampered with.
If you own a Ledger bought from a reseller
- If you haven't set the device up yet, don't start setup.
- If you've already set it up, consider moving your assets to a new Ledger with a new recovery phrase.
- Only buy from authorised sellers. Ledger's own Genuine Check can't detect an implant added inside the device, so a passing check isn't proof.
Why we're covering it this way
Stories like this spread fast with big numbers attached. We only publish figures we can check, and we say clearly when something is still unconfirmed.
Sources
BleepingComputer, "Ledger confirms hardware wallet spy implant behind crypto thefts":
bleepingcomputer.com
Get the next story checked before it's everywhere
Weekly, with sources. Free.
Join the Telegram channel