Ledger reviews wallet sales after $93 million crypto drain

Ledger is reviewing how its hardware wallets are sold and checked for tampering after a device implant was linked to crypto thefts estimated at about $93 million. The company asked resellers in Southeast Asia and Hong Kong to suspend sales while it investigates. Bloomberg reported the policy review; the loss estimate comes from blockchain analysts, and Ledger has not confirmed the total.

How could an implant expose a wallet’s recovery phrase?

A hardware wallet generates a recovery phrase during setup. The phrase can restore the wallet’s keys, so someone who obtains it can control the associated crypto. Ledger’s investigation found an unauthorized implant in at least one affected device. BleepingComputer reported that the implant could capture the 24-word phrase during setup and transmit it over LTE using an eSIM.

The implant is a separate component. It does not alter the Secure Element, which protects the wallet’s keys, or Ledger’s operating system. That separation matters: the device’s integrity checks look for changes to its normal components, while the added hardware sits outside them. It is like adding a hidden microphone to a locked room; the lock can still work as designed while the extra device records what happens inside.

The recovery phrase is the target because it can recreate the wallet’s keys. With those keys, an attacker can authorize transactions and move the funds. Ledger has confirmed finding an implant, but has not said that every drained wallet was compromised through the same method.

What is Ledger changing while it investigates?

Ledger CEO Pascal Gauthier said the company is reviewing controls for direct sales and resellers, while Chief Technology Officer Charles Guillemet said it is assessing device anti-tampering protections, according to Bloomberg. The sales pause gives Ledger time to examine how devices move through distribution and what checks might reveal physical changes before a buyer sets one up.

Ledger has also said all confirmed fund-loss cases so far involve devices sold by Southeast Asian reseller CryptoBilis. It says its own systems and direct sales channels remain unaffected. The company has asked authorized resellers and distributors to use approved sourcing channels and not restock returned products.

How certain is the $93 million figure?

Blockchain analytics firms traced about $93.2 million from wallets tied to the incident, according to CoinDesk. That is an on-chain estimate, not a confirmed Ledger loss figure. The estimate describes funds traced from affected wallets; it does not establish how each recovery phrase was exposed or identify who modified the devices.

The distinction is central to the review. A hardware wallet can protect keys inside its secure chip, but a recovery phrase exposed during setup can let an attacker rebuild access elsewhere. Ledger’s investigation is now focused on both parts of that chain: how devices reached buyers and how the hardware detects an unauthorized addition.