Ledger has introduced tighter controls on hardware wallet sales after criminals modified genuine devices and used them to steal cryptocurrency. In an October 15 statement, the company reaffirmed its ban on reselling returned wallets and ordered retailers to keep new devices off display shelves. The move follows the discovery that hidden components implanted in resold wallets captured customers' 24-word recovery phrases and transmitted them over mobile networks.

Criminals Altered Devices Before Resale

Ledger said attackers purchased legitimate wallets, fitted them with hidden components, and returned them to reseller channels in Southeast Asia. According to the company, the group spent months preparing the operation and built systems to collect recovery phrases and move stolen funds.

The operation shows how supply-chain tampering can defeat a hardware wallet without touching its cryptography: a recovery phrase is the master backup that can restore a wallet's accounts on any compatible device, so capturing those 24 words alone is enough to take control of the funds.

The investigation began on October 9, after customers reported missing assets from devices sold by CryptoBilis, a Malaysia-based reseller. An earlier Ledger wallet theft investigation connected the complaints to the reseller, which subsequently halted sales.

How the Hidden Implants Worked

Ledger's security team found an implant that copied the 24-word recovery phrase displayed during wallet setup. The component then sent those words through a mobile data connection using a built-in electronic SIM card. The company said the device's security chip and operating system intact.

That detail places the attack at the setup stage, when the phrase is displayed for the owner to record, rather than inside the device's secure hardware itself.

Binance founder Changpeng Zhao warned on X on October 9 that the evidence pointed to an attack through one seller, rather than a problem affecting all Ledger wallets.

Loss Estimates Rise as Investigators Trace Funds

Blockchain researcher Specter initially estimated losses above $86 million. However, Bitquery's October 15 update traced $102 million in stolen funds from 324 wallets across six networks. Earlier confirmation of device tampering established that investigators had found an unauthorized component. Ledger has not confirmed the total losses or the number of affected customers.

Bitquery said Tether froze $10 million in USDT linked to the theft. Its investigation also tracked stolen funds through swaps and privacy services. The researchers counted wallets rather than individual customers and noted that a single owner could control several affected addresses.

Ledger Changes Distribution and Customer Guidance

Ledger said its teams examined devices from stores in Germany and stock held in warehouses, and those samples showed no tampering. In an October 14 X update, the company called for a pause in sales across seven markets, including Hong Kong. Resellers in Asia suspended wallet sales as the investigation continued.

The new handling rules concentrate on the reseller stage, the point where the tampered units entered this case's supply chain, keeping devices under controlled storage until the moment of sale.

Under the new rules, authorized dealers must store wallets away from public shelves and hand devices to buyers at the point of purchase. Ledger advises CryptoBilis customers not to set up unused devices, while those who already initialized one should move their assets to a new wallet with a fresh recovery phrase. Open items in the case include a confirmed loss total — Ledger has not confirmed Bitquery's $102 million figure — and whether additional stolen funds are frozen beyond the $10 million in USDT Tether has already locked.