Crypto wallet maker Ledger has confirmed that a hardware wallet sold through a third-party reseller had been physically tampered with, after users who bought devices from that seller reported losing more than $86 million in cryptocurrency.
The affected devices were sold by CryptoBilis, a reseller based in Malaysia. Ledger said the incident, identified on October 9, involved a "limited" number of devices, and that its own systems had not been breached.
Investigators, including former Mt. Gox chief executive Mark Karpelès, found that a hidden implant fitted inside some devices could read what appeared on the wallet's screen. That would let attackers capture a user's recovery phrase during setup without being detected by Ledger's built-in Genuine Check. Some reports put the total losses closer to $93 million.
Ledger told its authorised resellers and distributors to source products only through official channels and never to restock returned devices. Buyers who got a device from CryptoBilis have been urged to move their funds to a new wallet set up with a fresh recovery phrase.
Over the weekend, social media users posted images of what they said were tampered devices bought from other resellers in Europe and the Philippines. Those claims have not been independently confirmed.
Ledger has said devices bought directly from the company are not affected. As a general precaution, users are advised to buy hardware wallets only from the manufacturer or authorised stores and never to use a device that arrives already set up or with a recovery phrase included.