Ledger tightens reseller rules after $93 million wallet theft

Ledger said on Oct. 15 it is tightening reseller rules and reviewing device protections after a reported $93 million theft linked to tampered hardware wallets. Ledger’s response described an attack through Southeast Asian resellers; Tom’s Hardware reported the estimated losses, citing Bloomberg.

What sales rules is Ledger changing?

Ledger told authorized resellers and distributors not to resell returned devices, even if they appear unopened, and said products should stay off shelves and displays. Under the new steps, stock must remain in the back and be handed to customers at purchase, and resellers must promptly report customer complaints about unusual devices, the company said.

Ledger also asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. The company said it screened samples from its stock and found no compromised units.

How did the implanted components steal funds?

Ledger said attackers bought genuine devices, opened them, installed hidden components designed to capture recovery phrases during setup, then returned the wallets to distribution through resellers in Southeast Asia. The company said its security lab examined the implant and that the attack targeted devices after they left Ledger’s control.

Tom’s Hardware reported the implant included a cellular or LTE module that transmitted recovery phrases. Ledger has said the incident did not involve a flaw in its chip, operating system or servers, and that its systems were not compromised.

What happens next?

Ledger said it is working with law enforcement and the security community to track funds and disrupt the attackers’ infrastructure. It plans to publish more details and share technical findings with industry peers when it can. The company also said it is working on additional product-level measures against similar attacks.

Source material

• Ledger’s response — ledger.com
• Tom’s Hardware reported — tomshardware.com