Ledger, the leading French manufacturer of hardware wallets for cryptocurrencies, has enforced stricter rules on sales channels after discovering that modified Ledger devices were used in a l
Ledger, the leading French manufacturer of hardware wallets for cryptocurrencies, has enforced stricter rules on sales channels after discovering that modified Ledger devices were used in a large-scale theft. The move comes as investigators report that more than $100 million in assets was stolen from user wallets by criminals who inserted hidden components into genuine devices before resale.
Attackers reportedly purchased authentic Ledger wallets, secretly added illicit hardware to them, and returned these compromised products to resellers, particularly in Southeast Asia. This alteration enabled the devices to capture sensitive customer information during setup.
The scheme was first flagged on October 9, when several customers noticed missing cryptocurrency from wallets bought via the Malaysian retailer CryptoBilis. Following these reports, CryptoBilis suspended wallet sales while an investigation was launched into the incidents.
Ledger reported that perpetrators spent months preparing the attack by buying back legitimate devices, installing covert components, and distributing them through regional sales partners. Secretly altered devices enabled the theft of users’ private recovery phrases and access to their funds.
Ledger’s security team identified a hidden implant inside the tampered wallets. This component copied the 24-word recovery phrase that appears during wallet setup—information critical to accessing and transferring cryptocurrencies on the device. The implant then transmitted the recovery phrase through a built-in electronic SIM card and mobile data connection.
Despite these modifications, the primary security chip and Ledger’s operating system reportedly remained unaffected. Former Binance CEO Changpeng Zhao commented on X, stating there was no evidence of widespread vulnerability and that the attack appeared limited to items sold via specific resellers.
Mini dictionary: CryptoBilis — A Malaysian retailer that sells hardware wallets and cryptocurrency accessories, mainly in the Southeast Asian market.
Initial analysis by blockchain researcher Specter estimated losses at over $86 million. However, Bitquery later traced stolen funds totaling $102 million from 324 wallets spread across six different blockchain networks. These figures represent one of the largest recorded hardware wallet breaches in the cryptocurrency space.
Analyst/Source Estimated Loss Wallets Impacted Date Specter $86 million Not specified October 2023 Bitquery $102 million 324 October 2023Bitquery also reported that Tether froze $10 million in USDT associated with the stolen funds. The investigation continues to follow the flow of unauthorized transfers, noting that the wallet count may not exactly match the number of individuals affected, as some users controlled multiple addresses.
Bitquery emphasized that while 324 wallets were compromised, the number of impacted customers may be smaller due to multiple wallet ownership. They tracked the proceeds of the crime as they moved through swaps and privacy services on the blockchain.
In response, Ledger has mandated that authorized dealers keep wallet devices off open display and not resell any returned devices. The company’s internal inspections in Germany and other warehouses found no tampering in on-hand device samples, but sales pauses were enacted in seven regional markets, including Hong Kong, while reviews continued.
Ledger is advising all customers who purchased through CryptoBilis to avoid using uninitialized wallets, and those who already used such devices to immediately transfer assets to a new wallet generated with a fresh recovery phrase. These measures aim to prevent further asset losses as the investigation unfolds.
The post Ledger tightens hardware wallet rules after $102 million theft linked to tampered devices appeared first on COINTURK NEWS.
