Ledger Reviews Sales Policies Following $90 Million Spyware Theft Incident
Ledger, a prominent hardware wallet manufacturer, is taking a closer look at its sales practices in light of a recent incident involving spyware thefts that resulted in substantial financial losses. Announced on October 13, 2026, the review comes after unauthorized hardware implants were discovered in devices sold through CryptoBilis, an authorized reseller based in Southeast Asia.
The compromised devices, which were primarily sold in Malaysia, Indonesia, and the Philippines, contained modifications that captured users' 24-word recovery phrases and transmitted them over LTE networks. This breach was particularly alarming as it undermined the core function of hardware wallets, which are designed to keep sensitive information offline.
Initial reports indicated that the financial impact of the thefts ranged from $72 million to over $93 million, with Bloomberg estimating the losses at approximately $90 million. Affected wallets spanned six different blockchain networks, leading to Tether freezing around $10 million in USDT linked to the incident.
In response to the situation, Ledger has advised recent buyers to refrain from initializing unused devices and migrating funds onto new hardware until the review is complete. The company has clarified that no devices sold directly through its own channels were compromised, pointing to the reseller's supply chain as the source of the issue.
MediaMarktSaturn Halts Ledger Sales
In a related development, MediaMarktSaturn, one of Europe’s largest electronics retailers, has suspended sales of all Ledger hardware wallets across 11 countries following user reports of unauthorized modifications. This decision was made on October 13, 2026, after alarming findings from a customer in Germany who discovered a hardware implant in their device.
Ledger's security team has confirmed the presence of these unauthorized implants in select units sold by CryptoBilis, which can exfiltrate recovery phrases without altering the device's appearance or functionality. Although MediaMarktSaturn's suspension appears to be precautionary, it underscores the need for buyers to verify the provenance of their devices.
As investigations continue, questions remain regarding the future of Ledger products at MediaMarktSaturn, the extent of the damages linked to CryptoBilis, and the overall impact on the hardware wallet market. Until these issues are resolved, users are reminded to be vigilant and cautious about where they purchase their devices.
Updated 18:01 UTC
New Developments in Ledger Incident
Ledger is currently investigating fund losses associated with a Southeast Asian reseller, following reports of tampered devices. The company confirmed that one user's device contained an unauthorized hardware implant.
Ledger has stated that the number of affected products is "limited" and has reached out to impacted customers. The investigation was initiated after users reported losing funds after purchasing from the Kuala Lumpur-based vendor CryptoBilis.
Blockchain investigator Specter reported that approximately $86 million had been drained from devices linked to this incident. Ledger has advised customers who bought from CryptoBilis not to set up their devices, and the reseller has ceased selling hardware wallets.
Security concerns in the hardware wallet space have been heightened, especially following a separate incident where hackers stole nearly $120 million from Coldcard users due to a firmware bug. Additionally, Trezor reported a data leak affecting around 81,000 customers due to a breach at a third-party fulfillment partner.
FAQ
What incident prompted Ledger to review its sales policies?
Ledger is reviewing its sales policies following a spyware theft incident that resulted in substantial financial losses, with unauthorized hardware implants found in devices sold through an authorized reseller.
Which regions were affected by the compromised Ledger devices?
The compromised devices were primarily sold in Malaysia, Indonesia, and the Philippines.
What advice has Ledger given to recent buyers of their hardware wallets?
Ledger has advised recent buyers to refrain from initializing unused devices and migrating funds onto new hardware until the review is complete.
What action has MediaMarktSaturn taken in response to the situation?
MediaMarktSaturn has suspended sales of all Ledger hardware wallets across 11 countries following reports of unauthorized modifications in the devices.
What should users do to ensure the safety of their Ledger devices?
Users are reminded to verify the provenance of their devices and remain cautious about where they purchase their hardware wallets.
Comments
Comments are moderated before publish.
No comments yet — be the first.