Reports of missing funds from Ledger wallets began on Friday, including some tied to devices bought from Malaysian reseller CryptoBilis. Galaxy Digital Inc. said late Friday the haul exceeded $90 million and spanned hundreds of cryptocurrency addresses. Posts on social media also flagged alleged losses or tampering outside Malaysia, including mentions of German electronics retailer MediaMarkt.
On Tuesday, CTO Charles Guillemet asked anyone who suspects their device was tampered with to first read Ledger's guidance on safely opening the hardware, then send any suspicious units to the company for further examination.
Hardware security reviews matter more as custody moves to self-held wallets. Market Briefs covers crypto infrastructure free every weekday.
"Physical supply chain tampering is a risk for the whole industry," CEO Pascal Gauthier said. "We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can." Other hardware wallet makers are rethinking reseller relationships as well. OneKey and Trezor said they are moving to halt or review some third-party ties, and OneKey CEO Yishi Wang said the change might wipe out an entire year's revenue for the Hong Kong-based company.
MediaMarktSaturn Retail Group said Tuesday it "has removed all of the manufacturer's products from its stores and online platforms and is in contact with the manufacturer." Ledger said it is looking into reports that devices sold in other channels carried spyware implants, and it has not confirmed how many users were affected or the aggregate losses. Big picture, attacks on crypto tech have surged this year, including against hardware long seen as a safer way to hold digital assets. For your own setup, the takeaway is simple: know your device, and pay attention to who sells it and how they vet it.
Trust in the device is the whole product. Join Market Briefs free and follow it.
