Ledger Confirms Unauthorized Hardware Implant, Potential Losses May Exceed $86M
Ledger, the hardware wallet manufacturer, has confirmed that one of the devices purchased through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant. The company is investigating the case which investigators from Specter estimate may have resulted in user losses exceeding $86 million across Bitcoin, Ethereum, and Tron. As a precaution, sales through the reseller have been halted, and users are urged to verify their devices and consider transferring assets if they have already set them up.
Discovery of Unauthorized Hardware Implant
Ledger confirmed that an unauthorized hardware implant was found in one of the devices purchased through reseller CryptoBilis. This implant, not authorized by Ledger, reportedly enabled attackers to gain access to users’ cryptographic keys, resulting in significant losses. The company announced the discovery in a post on its official X (formerly Twitter) account.
Incident Scope and Estimated Losses
Investigation by Specter estimates that total user losses may exceed $86 million across Bitcoin, Ethereum, and Tron assets. While Ledger did not specify the number of affected customers, it stated that the incident appears isolated to this single reseller and its market. Importantly, Ledger reassured that its own infrastructure, systems, and services were not compromised.
Response from Reseller and Ledger
Reseller CryptoBilis confirmed it has ceased all hardware wallet sales until the investigation concludes. Ledger is in active communication with CryptoBilis to determine next steps. Users who purchased devices from this reseller are advised not to initiate device setup. Those who have already set up their devices should consider moving assets to new Ledger hardware wallets using a new seed phrase.
User Guidance and Support
Ledger encourages anyone with relevant information regarding the investigation to contact their bounty program at bounty@ledger.fr. For assistance or inquiries, users should reach out to Ledger customer support via official channels at support.ledger.com.
Why it matters
This incident is highly significant for the hardware crypto wallet market as it highlights how supply chain compromises — in this case via a reseller — can lead to massive financial losses for users, exceeding $86 million. Ledger, a leading company in this sector, emphasized that the breach did not arise from their own products or services directly but from device tampering at an intermediary level. It underscores the critical importance of thorough verification and control over the purchase channels of hardware wallets, as well as users’ vigilance about their devices’ provenance. The steps taken to halt sales and urge asset transfers aim to mitigate further risks and losses.
Prepared from the source material with AI-assisted editing and checked against the supplied facts.
Open original source ↗