Ledger has implemented tighter sales controls after an investigation revealed that criminals purchased legitimate hardware wallets, installed hidden components, and returned them through reseller channels in Southeast Asia. The company announced the measures in an October 15 statement.
The hidden implants captured customers' 24-word recovery phrases during wallet setup and transmitted them through a mobile data connection using a built-in electronic SIM card. Ledger said the device's security chip and operating system remained intact, and the attackers spent months preparing the operation.
The investigation began on October 9 after customers reported missing assets from devices sold by Malaysia-based CryptoBilis. The reseller subsequently halted sales.
Estimated Losses and Fund Recovery
Blockchain researcher Specter initially estimated losses above $86 million. Bitquery's October 15 analysis traced $102 million in theft across 324 wallets spanning six networks. Ledger has not confirmed total losses or the number of affected customers.
Tether froze $10 million in USDT linked to the theft. Bitquery's investigation tracked stolen funds through swaps and privacy services, counting wallets rather than individual customers, as one owner could control several affected addresses.
New Distribution Requirements
Ledger examined devices from stores in Germany and warehouse stock, finding no tampering in those samples. The company has banned the resale of returned wallets and ordered authorized dealers to store new devices away from public display shelves, handing them directly to buyers at purchase.
Ledger advised customers who bought devices from CryptoBilis against setting up unused wallets. Those who already used one should move assets to a new wallet with a fresh recovery phrase.
