Ledger Tightens Reseller Rules After Tampered Wallets Linked to $102M Theft

Highlights:

• Ledger has tightened reseller rules after attackers planted hidden hardware in genuine wallets to steal recovery phrases.
• Blockchain investigators estimate $102 million was stolen from 324 wallets, though Ledger has not confirmed losses.
• Ledger asked resellers across Southeast Asia and Hong Kong to pause sales while it investigates the attack.

Crypto hardware wallet maker Ledger has introduced new rules for sellers of its hardware wallets after criminals planted hidden components in genuine devices to steal customers’ recovery phrases. Authorized sellers must now keep wallets away from public displays and hand them over only when customers make a purchase. The company also reminded sellers that returned devices cannot be sold again.

In an October 15 statement, Ledger said attackers had secretly modified genuine wallets and put them back into circulation through resellers in Southeast Asia. The theft came to light on October 9, when customers who bought devices from CryptoBilis reported missing funds.

Ledger: Organized Syndicate Infiltrated Supply Chain for Months to Implant Malicious Hardware and Steal Seed Phrases

In an updated investigation into the recent hardware wallet tampering incident, Ledger disclosed that an organized criminal syndicate spent months purchasing… pic.twitter.com/Cn1Wh8bBa1

— Wu Blockchain (@WuBlockchain) October 15, 2026

According to an October 15 update from Bitquery, attackers stole an estimated $102 million from 324 wallets across six blockchains. Tether also froze $10 million in USDT linked to the theft. However, Ledger has not confirmed the total losses.

How Attackers Modified Genuine Ledger Wallets

According to Ledger, the group spent months buying authentic devices, opening them and fitting custom hardware inside. The wallets were then placed back into distribution channels, where buyers could mistake them for untouched products.

The hidden components were designed to capture a wallet’s recovery phrase during setup. That phrase is a collection of words used to restore access to crypto funds. Anyone who obtains it can potentially move the assets without having the physical wallet.

Ledger said the criminals also built servers to collect stolen phrases and systems to move and conceal the stolen funds. The company maintains that its security chips, operating system and servers were not breached. Instead, the company says attackers altered the devices after they left Ledger’s control.

New Rules for Ledger Resellers Take Effect Immediately

Ledger said it contacted authorized resellers and distributors on October 15 with stricter instructions for handling stock. Stores must stop placing products on shelves or in display areas. Instead, they must keep devices in storage and hand them to customers at the point of sale.

The company also reinforced an existing ban on reselling returned devices. That rule applies even when a wallet appears unopened or unused. Sellers must promptly report customer complaints about unusual devices. The steps are taken to limit opportunities for tampered wallets to reach buyers. The company said it is developing further product-level protections but did not provide a release date or technical details.

Ledger Investigates Attack as Sales Pause in Asia

Ledger said its security team, known as the Donjon, examined an implant to understand how it operated. Investigators also bought devices from stores in markets including Germany and checked warehouse samples. None of the units they examined showed signs of tampering, according to the company.

Ledger meanwhile has instructed authorized sellers and distributors in Southeast Asia and Hong Kong to halt sales. It also checked some of its own stock and said it did not report any infected devices. Also, Ledger has been collaborating with law enforcement and security experts to track down the stolen money and the perpetrators of the attack. It aims to provide more technical insights to other hardware wallet manufacturers, if applicable.

The company described the incident as a targeted distribution attack rather than a failure across its entire supply chain. It has not confirmed the total financial losses or a date for resuming sales to affected resellers.