Ledger reviews device sales policies after $90 million spyware theft

Ledger is taking a hard look at how its hardware wallets reach customers. The French company is reviewing its device sales policies after spyware thefts caused $90 million in losses, Bloomberg reported. Ledger SAS announced the review on October 13, 2026. It covers the company’s consumer device sales policies and processes, and it follows a supply-chain attack tied to one of its authorized resellers. How the attack worked The compromised devices were sold through CryptoBilis, an authorized Ledger reseller. The incident first surfaced around October 9, 2026. Most affected units went to buyers in Southeast Asia. Malaysia, Indonesia, and the Philippines were the main markets hit. The devices reportedly contained unauthorized hardware implants. These implants read the 24-word recovery phrase shown on the device screen during setup. The implants then sent the captured phrases out over LTE using an eSIM. Ledger’s Genuine Check protocol, designed to confirm a device is authentic, failed to detect the hidden implants after extensive analysis. The damage, by the numbers Loss estimates range from $72 million to over $93 million. Bloomberg put the figure at $90 million. The thefts hit 315 wal...