Ledger has told resellers and distributors across several Asian markets to stop selling its hardware wallets and remove them from store shelves while it investigates a supply-chain attack involving tampered devices. The wider halt covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, extending an earlier restriction that had focused on Southeast Asian reseller CryptoBilis.
The company said every confirmed loss it has traced so far involves devices sold by CryptoBilis. At the same time, onchain investigator Specter has linked the incident to more than $86 million in suspected thefts dating to Oct. 9, a figure Ledger said it has not independently verified.
How the implant worked
According to Ledger, its Donjon security team found that some signers sold by CryptoBilis had been fitted with a hidden implant inside the device casing. During setup, a microcontroller inside that implant could read the 24-word recovery phrase as it appeared on the wallet screen and send it over the LTE mobile network through an eSIM.
Possession of that recovery phrase would allow an attacker to restore the wallet elsewhere and move the funds. Ledger said the implant did not modify the Secure Element, the operating system or transaction data, and added that it has seen no indication its own infrastructure, services or direct sales channel were compromised.
The company said it is still trying to determine who altered the devices and at what stage of the distribution chain the tampering occurred.
Cases spread beyond the initial reseller
The investigation broadened on Tuesday after former Mt. Gox chief executive Mark Karpelès published a teardown of a Ledger Flex that he said contained a spy implant. The unused wallet belonged to Ben Yorke of WOO, who noticed unusual marks and sent the device to Karpelès for inspection.
Yorke said the wallet had been purchased from a retailer called Metapod at Singapore's airport. If confirmed, that would make it the first reported tampered unit sold by a reseller other than CryptoBilis. Ledger has not confirmed that the Singapore device is linked to the earlier cases.
In Europe, MediaMarkt Saturn also stopped selling Ledger devices with Ledger's agreement after a customer in Germany reported an implant. No loss of funds was reported in that case.
Trezor tightens distribution
The incident prompted a response from rival hardware wallet maker Trezor, which said it will shrink its reseller network because of what it called recent supply-chain incidents. Chief commercial officer Danny Sanders said the change reflects the number of partners the company can closely vet itself.
Under the plan, affected resellers will lose authorization on Jan. 1, 2027, will not receive new stock and will be removed from Trezor's list of approved sellers. They may continue selling existing inventory through the holiday season, while the resellers that remain will face stricter requirements for sourcing, storage and handling.
Trezor said it has no evidence that its own devices were compromised and described the move as a precautionary step to protect its supply chain and customers.
Why the case stands out
Ledger customers have been targeted before with altered hardware. After the company's 2020 data breach exposed the names and addresses of hundreds of thousands of buyers, scammers mailed some customers counterfeit devices containing extra components.
This latest case is viewed as more serious because the suspect wallets appear to have reached buyers through normal retail channels rather than obvious scam shipments. That would have given customers little reason to suspect that a sealed device purchased in a store had been modified.
Ledger CTO Charles Guillemet said the company is reviewing reseller controls and anti-tamper protections. Until the source of the alterations is identified, Ledger said the safest option is to buy directly from manufacturers and to treat any device showing signs of tampering or presenting a pre-set recovery phrase as compromised.
Source: www.blockhead.co