Ledger asked distributors and retailers of its digital wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove them from shelves while the company investigates cases of hardware tampering linked to a supply chain attack.
The decision came after Ledger confirmed that some devices sold by the Asian distributor CryptoBilis had been modified in a way that enabled the theft of recovery phrases used to access crypto assets. According to the company, users reported multiple financial losses, prompting it to begin investigating on October 9.
Hardware Implant Bypasses Safety Checks
Ledger’s Donjon security division disclosed additional details about the component implanted inside the devices, largely confirming earlier reports published by Mark Karpelès and Tibane Labs. The component operates through a microcontroller that detects the 24-word recovery phrase and decodes it while the wallet is being set up or restored, then sends it to an unauthorized party over an LTE connection using an activated eSIM.
Ledger explained that the implant is a separate component that does not modify the Secure Element or the Ledger operating system, and does not alter transactions or signatures. As a result, the modified devices were able to bypass the self-integrity checks performed by Ledger, demonstrating that software integrity alone is insufficient to verify a hardware device that was tampered with before reaching the user.
Reports Extend Beyond CryptoBilis
Ledger said that all confirmed losses so far are linked to devices sold by CryptoBilis, but users also reported compromised devices purchased from other sellers in Asia and Europe. The reports included devices purchased from the Metapod technology store at one of Singapore’s airports and from the MediaMarkt chain in Europe.
Following these reports, MediaMarkt removed the products from its shelves. The chain obtains Ledger devices from the distributor Aqipa GmbH. Ledger also expanded its sales suspension decision to include all of its distributors in the aforementioned Asian countries and Hong Kong until investigations into device integrity are completed.
In contrast, Ledger confirmed that its infrastructure, systems, services, and direct sales channel are safe to use, according to the source material.
Why Does This Matter?
The incident shows that the hardware supply chain represents a trust point independent of the operating system and internal security components. The tampering occurred through the addition of a separate component capable of capturing recovery data without modifying the elements relied upon by Ledger’s checks, making the device’s source and its storage and distribution path an essential part of the protection model.
Trezor, the main competitor in the hardware wallet market, took a parallel precautionary step by announcing a reduction in its distributor network and stricter legal requirements and checks related to the source, storage, and handling of devices. The company said it had found no evidence that its devices had been compromised, but it will terminate some distributors’ partnerships on January 1, 2027, and revoke their authorization to sell.