Ledger has suspended its reseller network across Southeast Asia after thieves used tampered hardware wallets to steal more than $103.4 million from 530 addresses, according to the company and blockchain analysis cited in reports. Ledger said the confirmed thefts identified so far are limited to Asia.
One of the affected wallets belonged to a scammer, Chainalysis reported, in an unusual twist to the incident. The firm said the person lost 60 Bitcoin, worth about $4.8 million, after buying three compromised Ledger devices that captured seed phrases and allowed attackers to empty the funds.
How the thefts were carried out
The attack involved Ledger devices that had been inserted into the supply chain after being altered with spyware. According to the report, the malware recorded users’ seed phrases, giving attackers the information needed to later drain the wallets.
Chainalysis said the scammer’s 60 BTC was spread across three newly purchased Ledgers and that the attackers moved all of the funds into the same destination wallet. The broader campaign is reported to have affected 530 addresses, with total losses exceeding $103.4 million.
A victim who was also accused of scamming others
Chainalysis said the wallet owner who lost the 60 BTC had operated a so-called task scam. In that scheme, people were reportedly paid to generate fake sales and reviews for real products.
The blockchain analysis firm said participants were later shown a negative balance and told to deposit their own money in order to receive payment. Based on that account, the person who lost funds in the Ledger incident was allegedly involved in defrauding others before becoming a victim of the supply-chain attack.
Ledger narrows confirmed cases to Asia
Ledger said all confirmed thefts to date have been in Asia, even though there were reports that tampered devices had appeared in Europe and that electronics retailer MediaMarkt had suspended sales. The company asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to remove Ledger products from sale.
The company’s move effectively pauses its reseller channel across that part of the market while the incident is addressed. The report did not say when sales through those resellers might resume.
Broader fallout for hardware wallet sellers
The incident has quickly become a major setback for the hardware wallet sector. The source described it as the worst scandal involving such devices since the Coldcard seed phrase controversy at the end of July.
At the same time, Ledger introduced a new device called Atom, priced at $849. Ledger says the wallet combines crypto storage with Android apps while keeping app activity separated from sensitive wallet functions. The company also claims Atom includes protections that would block the type of implant used in the Asia thefts and can detect tampering even when the device is switched off.
The fallout has also influenced rivals. Trezor said it will close some of the more distant resellers in its network from Jan. 1 because it cannot guarantee the same level of oversight it can provide to partners closer to home. There have been no reports of tampered Trezor devices.
Source: cointelegraph.com