Ledger 审查销售政策应对 9000 万美元硬件窃密事件
Ledger reviews device sales policies after $90 million spyware theft
Ledger 宣布审查设备销售流程，此前其授权经销商 CryptoBilis 出售的硬件钱包被植入窃密芯片，导致 315 个钱包资产被盗，损失约 9000 万美元。Tether 冻结了约 1000 万 USDT，Ledger 建议新购用户暂不初始化设备。
硬件钱包供应链被植入窃密芯片，Genuine Check 协议失效，用户需警惕二手设备风险。
Ledger is taking a hard look at how its hardware wallets reach customers. The French company is reviewing its device sales policies after spyware thefts caused $90 million in losses, Bloomberg reported.
Ledger SAS announced the review on October 13, 2026. It covers the company’s consumer device sales policies and processes, and it follows a supply-chain attack tied to one of its authorized resellers.
How the attack worked
The compromised devices were sold through CryptoBilis, an authorized Ledger reseller. The incident first surfaced around October 9, 2026.
Most affected units went to buyers in Southeast Asia. Malaysia, Indonesia, and the Philippines were the main markets hit.
The devices reportedly contained unauthorized hardware implants. These implants read the 24-word recovery phrase shown on the device screen during setup.
The implants then sent the captured phrases out over LTE using an eSIM.
Ledger’s Genuine Check protocol, designed to confirm a device is authentic, failed to detect the hidden implants after extensive analysis.
The damage, by the numbers
Loss estimates range from $72 million to over $93 million. Bloomberg put the figure at $90 million.
The thefts hit 315 wallets across six chains.
Tether froze approximately $10 million in USDT linked to the suspected thefts. Because USDT is issued by a central company, Tether can lock tokens at specific addresses, something that isn’t possible with assets like Bitcoin.
Ledger told recent buyers not to initialize unused devices. It also advised them not to migrate funds onto new hardware while the situation is assessed.
A reseller under new ownership
CryptoBilis changed hands in March 2026. The unauthorized implants were reportedly introduced after the new owner took over.
Ledger says no devices sold through its direct sales channels were compromised. The company is pointing to the reseller’s supply chain as the weak link.
Reports of similar implants have emerged from Europe, including devices sold at MediaMarkt, the electronics retailer.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.
来源：Crypto Briefing · cryptobriefing.com