Ledger Probes Fund Theft After Implant Found in Reseller Device

Ledger stated it is cooperating with law enforcement following reports last week of users losing money, with one individual receiving a compromised device. The firm assured clients that only a "limited" number of products were affected.

In a Sunday announcement, the hardware wallet maker said it had contacted those impacted.

On Friday, Ledger, headquartered in Paris, announced it had launched a probe after customers in Southeast Asia reported fund losses following purchases from a reseller.

The following day, Ledger confirmed that one affected user's device had an unauthorized hardware implant.

Ledger declined to specify the total losses, but blockchain investigator Specter stated that $86 million had been taken from devices.

"As the investigation continues, we are working with relevant authorities," Ledger posted on Sunday.

The company added: "Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.

"Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes."

Last week, customers in Southeast Asia reported losses after making purchases from CryptoBilis, a vendor based in Kuala Lumpur, Malaysia.

Following this, Ledger recommended that those who bought from CryptoBilis should refrain from setting up their devices.

Ledger noted on Sunday that CryptoBilis had ceased selling its hardware wallets.

Social media users shared images showing implants inside Ledger products, alleging that these could access users' private keys. The number of Ledger signing devices affected by the implant remains unclear.

Neither Ledger nor CryptoBilis provided immediate responses to inquiries from Bitcoin Magazine.

The security of hardware wallets has been a subject of intense discussion since July, when hackers stole nearly $120 million in bitcoin from Coldcard users.

Those Coldcard devices, manufactured by Canada's Coinkite, had a firmware flaw that caused incorrect seed generation, enabling hackers to effectively guess investor seed phrases.

Separately, Trezor, another hardware wallet maker, disclosed last month that approximately 81,000 customers had their information exposed after a data breach at its third-party fulfillment partner.

This year has seen criminals increasingly targeting data, with scammers using Ledger's payment processor Global-e to obtain customer information and send phishing emails.