A US$90mil spyware hack sparks review of crypto wallet sales

Crypto hardware maker Ledger SAS is reviewing its policies and processes for how its devices are sold to consumers, after spyware implanted in some wallets led to an estimated US$90mil (RM367mil) in stolen cryptocurrency.

The Paris-based firm is also assessing its anti-tampering protections, Ledger chief technology officer Charles Guillemet said in a social media post on Oct 13. He asked users who suspected their devices had been tampered with to review Ledger’s guidelines for how to safely open up their hardware before doing so, and to send any suspicious devices to Ledger for further examination.

"Physical supply chain tampering is a risk for the whole industry,” added Pascal Gauthier, Ledger’s chief executive officer, in a separate post. "We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can.”

The incident is prompting other crypto hardware wallet providers to reassess how they work with third-party resellers, with OneKey and Trezor moving to halt or review some reseller relationships, according to posts by the companies on social media. For Hong Kong-based OneKey, the changes could result in the loss of an entire year’s worth of revenue, its CEO Yishi Wang said.