Ledger tightens reseller rules after implanted wallets steal crypto

Ledger is tightening reseller rules after a hidden hardware implant in at least one of its devices was linked to crypto theft, putting the handling of wallets before sale under scrutiny. Tom’s Hardware, citing Bloomberg, reported that the thefts totaled $93 million; Ledger’s own account confirms an implant in the incident but does not give a total loss figure.

A hardware wallet holds the keys used to authorize crypto transactions. During setup, the user creates a recovery phrase that can restore access to those keys. Researchers cited by Quartz reported that implants found in Ledger Nano X devices captured screen output and button presses to obtain seed phrases, then sent the data over an LTE connection. With the phrase, attackers could access the associated wallets.

How did an implant reach customers?

Ledger says criminals bought genuine devices, opened them, fitted hidden components designed to capture recovery phrases during setup, then put the wallets back into distribution through resellers in Southeast Asia. That puts the reported tampering after the devices left Ledger’s control. Ledger said its security lab, the Donjon, examined an implant and that its checks of sampled stock and store-bought devices found no other compromised units.

The company’s Genuine Check verifies device authenticity, but Quartz reported that it is not designed to detect extra hardware attached to a device if the original Secure Element remains intact. The check could therefore pass on a genuine Ledger whose internals had been altered. This attack targeted the path from manufacturer to buyer, rather than requiring a software breach in Ledger’s systems.

What is Ledger changing for buyers?

In its October 15 response, Ledger said it had asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. It also told its network that returned devices must never be resold, even if they appear unopened. New instructions say products should stay off shelves and displays, remain in back-room stock, and be handed to customers at purchase. Resellers must promptly report customer complaints about unusual products.

These steps change how retailers handle a wallet between delivery and sale. Keeping stock out of display areas reduces the time devices sit accessible to shoppers; banning resale of returns closes a route by which a modified device could re-enter circulation. The rules add handling controls around the existing authenticity check.

What does Ledger say about the scope?

Ledger called the incident a localized distribution attack, not a systemic supply-chain compromise, and said its chip, operating system, servers and direct systems were not compromised. It has not published a total number of affected users or a final loss estimate in its response. The company said it is working with law enforcement and the security community, and that it is developing additional product-level measures to deter this kind of tampering.

For wallet buyers, the incident shows why the seller and the device’s path to the buyer matter alongside the wallet’s software checks. Ledger’s new reseller instructions address that gap in handling, while the company says further technical details will follow.