Ledger reviews its sales policies after $90 million spyware theft

Ledger SAS, a maker of hardware crypto wallets, is reviewing the policies and processes it uses to sell its devices to consumers. The reason is spyware that turned out to be planted in some of the wallets, which is estimated to have enabled the theft of about $90 million in cryptocurrency. Bloomberg reported this on October 13, 2026.

The sum is large even by crypto-market standards, where thefts of tens of millions have long been commonplace. But those usually happen at exchanges and in DeFi protocols. Here, the victims are owners of devices they bought precisely to protect themselves from such scenarios.

What is known so far

The initial report is short, and many details remain undisclosed. The company has not said how the spyware got onto the devices, how many wallets are affected, or how many users lost funds. The wording about reviewing sales rules suggests the problem lies in the chain between the factory and the buyer, not in firmware that is already running. That is an inference from the company's statement, not a confirmed fact.

• Losses: about $90 million in cryptocurrency (estimate).
• Vector: spyware planted in "some" wallets.
• Ledger's response: a review of the policies and processes for selling devices to consumers.
• Not disclosed: how the spyware was planted, the number of victims, possible compensation.

Why the sales channel is in question

A hardware wallet sells one idea: private keys are generated and stored inside the device and never leave it. That guarantee holds only for a device that reaches its owner in its original state. If someone tampers with the hardware, firmware, or contents of the package on the way to the buyer, the protection is gone before the first transaction. The user may notice nothing: the interface looks familiar, while the attacker gains access to what was supposed to stay secret.

That makes a review of sales rules logical. Third-party resellers, marketplaces, packaging, and authenticity checks could all come under scrutiny. Which measures Ledger will choose is not yet known.

Reputational background

This is not the first trust problem for Ledger. In 2020, a leak of its customer database led to users receiving phishing mailings. In 2023, the Ledger Recover key-recovery service sparked controversy in a community that had come to treat "keys do not leave the device" as an inviolable rule. In December 2023, the Connect Kit library was compromised, and the attack hit third-party dApps. Now comes a case in which suspicion falls on the device's very path to the buyer. For a brand built on trust in its hardware, this is the most sensitive scenario.

What owners should do

Until official details emerge, it makes sense to assume the worst and take basic precautions:

• Buy wallets only from the manufacturer's official store or from vetted authorized partners. Marketplace discounts are not worth the risk.
• Inspect the packaging and seals. Any sign of tampering is a reason to return the device.
• Initialize the wallet yourself. If the box contains a ready-made seed phrase or a card with words already written on it, do not use the device.
• Run the device authenticity check in the official Ledger Live app.
• Never enter your seed phrase into a computer or phone. A legitimate wallet asks for it only during recovery on the device itself.
• Keep large sums in multisig or across several devices from different manufacturers, so that compromising one does not open access to everything.

If you bought a Ledger from anyone other than the manufacturer directly, it is better to move your funds to a newly generated wallet on a device you know to be clean. The rest will become clear when Ledger publishes the results of its review.