Ledger has said it is working with authorities after users last week reported losing funds and one received a tampered device. But the company reassured customers that the number of impacted products was “limited.”
The hardware wallet manufacturer added in an announcement on Sunday that it had reached out to affected customers.
Paris-based Ledger on Friday said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from a reseller.
Then, on Saturday, Ledger said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant.
Ledger would not confirm the amount of money lost but blockchain investigator Specter said $86 million had been drained from devices.
“As the investigation continues, we are working with relevant authorities,” Ledger wrote on Sunday.
It added: “Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.
“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.”
Customers in South East Asia last week reported losing funds after buying from Kuala Lumpur, Malaysia-based vendor CryptoBilis.
Ledger then advised customers who’d bought from CryptoBilis to not set up their devices.
CryptoBilis has since stopped selling its hardware wallets, Ledger said on Sunday.
People on social media posted picture evidence of devices implanted into Ledger products, claiming it could get users’ private keys. It isn’t clear how many of Ledger’s signing devices contained the implant.
Neither Ledger nor CryptoBilis immediately responded to questions from Bitcoin Magazine.
Hardware wallet security has been a hot topic ever since hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.
The products, made by Canadian company Coinkite, contained a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases.
In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen.
Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.
