Ledger Investigates Unauthorized Implant in Wallets Linked to $93 Million Theft

Ledger has confirmed the discovery of an unauthorized hardware implant in one of its wallets, coinciding with an investigation into approximately $93 million in suspected cryptocurrency thefts. This incident is primarily linked to devices sold through CryptoBilis, an authorized reseller in Southeast Asia, which has since halted all hardware wallet sales pending the investigation's outcome.

On October 10, Ledger stated that independent investigators, including former Mt. Gox CEO Mark Karpelès, are examining the modified devices. These investigations have revealed that the implants can intercept recovery phrases by monitoring electronic signals between a wallet's secure element and its display. This allows attackers to reconstruct recovery phrases and access victims' wallets without needing to physically steal the devices.

While Ledger has not confirmed how many devices were affected or whether the implant caused all reported losses, it maintains that its security infrastructure remains uncompromised. The company has advised customers who purchased devices from CryptoBilis not to initialize unused wallets and to transfer funds to a new wallet with a different recovery phrase if they have already set up their devices.

Estimates of the thefts vary, with Galaxy Digital reporting approximately $91 million drained from affected wallets, while blockchain analytics firm Bitquery estimates the total at around $93.2 million. Both reports indicate that the thefts involved multiple blockchains and suggest that the attackers executed a coordinated withdrawal operation shortly after the initial reports of missing funds.

In light of these developments, Ledger is working closely with authorities and impacted users to enhance its anti-tampering protections and prevent future incidents.