A $90m spyware hack sparks review of crypto wallet sales

Crypto hardware maker Ledger SAS is reviewing its policies and processes for how its devices are sold to consumers, after spyware implanted in some wallets led to an estimated $90 million in stolen cryptocurrency.

The Paris-based firm on Tuesday said it asked resellers in Southeast Asia and Hong Kong to suspend sales of its devices. Chief Technology Officer Charles Guillemet said in a separate social media post that Ledger is also assessing its anti-tampering protections. He asked users who suspected their devices had been tampered with to review company guidelines for how to safely open up their hardware and to send any suspicious devices to Ledger for further examination.

“Physical supply chain tampering is a risk for the whole industry,” added Pascal Gauthier, Ledger’s chief executive officer, in another post. “We are reviewing the controls that apply to our direct sales and to resellers, and we will what we can.”

The incident is prompting other crypto hardware wallet providers to reassess how they work with third-party resellers, with OneKey and Trezor moving to halt or review some reseller relationships, according to posts by the companies on social media. For Hong Kong-based OneKey the changes could result in the loss of an entire year’s worth of revenue, its CEO Yishi Wang said.

Users began reporting fund losses from Ledger wallets on Friday, some of which were connected to devices purchased from Malaysian reseller CryptoBilis. The total amount lost in the incident has been estimated at more than $90 million across hundreds of cryptocurrency addresses, according to research published late Friday by Galaxy Digital.

Some social media posts alleged losses or tampering of Ledger devices beyond Malaysia, including from German electronics retailer MediaMarkt. Ledger said it was reviewing reports of spyware implants in devices sold elsewhere, but had not yet confirmed the total number of users affected or total losses.

The MediaMarktSaturn Retail Group “has removed all of the manufacturer’s products from its stores and online platforms and is in with the manufacturer,” a spokesperson said in an emailed response to questions on Tuesday.

Attacks on crypto companies and technology have ramped up significantly this year, including against hardware which was long considered among a more secure way to protect digital assets.