Ledger to Review Sale Policies After Crypto Spyware Attack

Hardware wallet users face a new risk of compromised recovery phrases from reseller supply chains, potentially costing millions in stolen crypto.

A security breach involving hardware cryptocurrency wallets, specifically Ledger models, has resulted in the theft of at least $93 million. The attack exploited secretly installed eSIM and LTE modules within wallets purchased from third-party resellers in Southeast Asia and Europe. These modules enabled the exfiltration of users' crypto recovery phrases. Ledger has stated that hardware sold directly by the company remains unaffected. One affected reseller, Cryptobilis, which operated in Malaysia, Indonesia, and the Philippines, has suspended all hardware wallet sales following the discovery of the compromised units. Researcher Mark Karpelès has been investigating these compromised wallets.

This incident highlights a significant vulnerability in the hardware wallet supply chain, shifting the threat from direct device tampering to infiltration during distribution. The reliance on third-party resellers introduces a critical weak point where malicious actors can introduce compromised components before the product reaches the end-user. This broadens the attack surface beyond the manufacturer's direct control and raises questions about the integrity of distribution networks for sensitive hardware.

The $93 million figure underscores the substantial financial motivation for such sophisticated attacks and the potential impact on individual users and the broader cryptocurrency ecosystem. As Ledger reviews its sales policies, the industry will be watching for new security protocols and vetting processes for resellers to prevent similar breaches. This event could lead to increased scrutiny of supply chain security for all hardware wallets and digital asset management solutions.