Wallet Makers Are Reviewing Resellers After a $90 Million Spyware Attack
Ledger is reviewing how its devices are sold after spyware implanted in some of its hardware wallets led to an estimated $90 million in stolen funds across hundreds of addresses, according to research published by Galaxy Digital. The estimate is up from roughly $70 million on Friday. Chief executive Pascal Gauthier said physical supply chain tampering is a risk for the whole industry, and that the company is reviewing the controls on both its direct sales and its resellers.
Per Bloomberg, Emily Nicolle reports that the incident is no longer confined to one distributor or one manufacturer. Losses were first tied to devices bought from Malaysian reseller CryptoBilis. Social media posts have since alleged tampering or losses involving devices sold elsewhere, including through German electronics retailer MediaMarkt. Ledger says it is reviewing reports of spyware in devices sold outside Malaysia but has not confirmed the number of users affected or the total lost. MediaMarktSaturn Retail Group said it has removed all Ledger products from its stores and online platforms and is in contact with the company.
Competitors are responding to the same risk. Trezor and OneKey have moved to halt or review some reseller relationships, according to posts by both companies. OneKey chief executive Yishi Wang said the changes could cost the Hong Kong firm a full year of revenue, which indicates how much hardware wallet distribution depends on third-party channels.
Ledger is also reassessing its anti-tampering protections. Chief technology officer Charles Guillemet asked users who suspect their devices have been altered to follow the company's guidance before opening them and to send suspicious units to Ledger for examination. The company had said on Friday that it had no reports involving devices bought directly from it, or involving its own systems.
The mechanism now has a name, and it changes the reading of last week. Spyware implanted in the device means the compromise happened before the user ever generated a key, somewhere between the factory and the buyer. A hardware wallet's security model depends on the device being exactly what the manufacturer shipped. When that assumption fails, the cryptography inside works as designed on behalf of the wrong party. The response from three manufacturers within days suggests the industry does not regard this as a single bad distributor.
The practical implications are concrete. Buy directly from the manufacturer. Treat any device from a third party as unverified until it has been checked against the maker's guidance. Do not rely on a single device holding a single key for meaningful balances, because a compromise of that one device is sufficient to move everything on it. Spreading signing authority across multiple keys on multiple devices from separate sources means one tampered unit cannot empty a wallet on its own.
What to watch is Ledger's confirmed count of affected devices and regions, and what Trezor and OneKey disclose about their own reviews. A supply chain attack is defined by how far the chain reaches, and that has not yet been established.