French firm Ledger said in an Oct. 11 statement that it has only identified cases of the Oct. 9 crypto theft with devices that were bought from CryptoBilis, an authorized reseller for Southeast Asia.
"The number of impacted devices is limited," Ledger said without revealing the precise number of compromised wallets.
The firm also emphasized that the incident did not affect its systems or direct sales.
Meanwhile, Ledger is collaborating with the appropriate authorities to determine how the thefts occurred. The company is also contacting the affected customers.
The new statement comes as reports suggest that a significant amount of cryptocurrency has been lost. Blockchain investigators estimate the potential losses to be over $86 million, though the figure has not been confirmed yet.
Unauthorized hardware implant found
This is the latest in a series of concerning findings related to the ongoing investigation.
As previously reported, Ledger said that it found an unauthorized hardware implant on one of the compromised customers' devices. This has led to fears that some wallets may have been altered before they were delivered to customers.
However, investigators are still determining whether the same changes caused all the reported thefts.
Following the incident, CryptoBilis announced that it has halted sales of all hardware wallets until further notice.
Meanwhile, Ledger has also strengthened its supply chain security, including its authorized reseller system, and has made enhancements to its hardware against physical tampering.
The firm has also reminded distributors to source products only from authorized sources and not to resell returned devices.
Ledger also acknowledged that the problem is not limited to them. The firm has urged other hardware wallet providers and security researchers to bolster industry security against tampering attacks.
Arman Shirinyan
Dan Burgin
