People buy cold wallets for peace of mind. But early this morning Beijing time, Ledger confirmed that at least one user’s device had been fitted with an unauthorized hardware implant in a series of Southeast Asian thefts involving assets worth $BTC and more.
Bitcoin is money many people plan to leave untouched for the long term. That’s why they pay for a hardware wallet—to keep their private keys offline.
The affected devices were all purchased from CryptoBilis, a Southeast Asian reseller that has stopped selling all its hardware wallets while the investigation is underway.
This wasn’t a phishing website or a software vulnerability. The devices had been tampered with before they reached their buyers. Ledger said its systems and services had not been compromised, and that the issue currently appears to be limited to this one reseller.
On-chain investigators estimate the losses at tens of millions of dollars, though Ledger has not confirmed a specific amount.
Ledger’s advice: If you bought a device from this reseller and haven’t set it up yet, don’t turn it on. If you’re already using one, switch to a new Ledger, generate a new recovery phrase, and transfer your assets over.
It also warns that the company will never ask you for your 24-word recovery phrase. Scams involving people posing as customer support are especially common in situations like this.
Bitcoin is money many people plan to leave untouched for the long term. That’s why they pay for a hardware wallet—to keep their private keys offline.
The affected devices were all purchased from CryptoBilis, a Southeast Asian reseller that has stopped selling all its hardware wallets while the investigation is underway.
This wasn’t a phishing website or a software vulnerability. The devices had been tampered with before they reached their buyers. Ledger said its systems and services had not been compromised, and that the issue currently appears to be limited to this one reseller.
On-chain investigators estimate the losses at tens of millions of dollars, though Ledger has not confirmed a specific amount.
Ledger’s advice: If you bought a device from this reseller and haven’t set it up yet, don’t turn it on. If you’re already using one, switch to a new Ledger, generate a new recovery phrase, and transfer your assets over.
It also warns that the company will never ask you for your 24-word recovery phrase. Scams involving people posing as customer support are especially common in situations like this.