In a troubling development for cryptocurrency security, Ledger has disclosed that its hardware wallets may have been compromised by criminals, leading to potential theft of customer funds. Following these revelations, major European retailer Mediamarkt Saturn has temporarily ceased sales of Ledger devices.
Investigations revealed that attackers had secretly installed hardware implants within Ledger wallets, capable of capturing users' 24-word recovery phrases and transmitting them via cellular networks. Initial estimates of losses have surged from $86 million to $93 million, although Ledger cautions that these figures remain unverified.
Ledger's security team, known as Donjon, explained that the implant operates discreetly, reading data displayed on the wallet's screen during setup. When the recovery phrase appears, the implant decodes and sends this sensitive information over LTE using a provisioned eSIM.
As a precautionary measure, Ledger has advised customers who purchased wallets from the Southeast Asian reseller Cryptobilis to refrain from activating their devices until further notice. The company has yet to confirm the total number of affected users or the overall value lost.
In light of the growing concerns, Mediamarkt has halted the sale of Ledger wallets following reports of tampering in Germany. Although no confirmed financial losses have been reported from these devices, the situation has raised alarms among consumers and competitors alike.
In response to the incident, rival hardware wallet manufacturer Trezor is tightening its reseller network, highlighting the increasing focus on supply chain security in the crypto space.
