Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents.
The company announced the decision in response to discovering that devices purchased from CryptoBilis had been modified to steal seed phrases used to access crypto assets and send them to an unauthorized party over an LTE connection.
Ledger sells physical cryptocurrency wallets that securely store private keys used for managing and authorizing digital asset transactions.
Following reports of cryptocurrency losses from multiple users, Ledger launched an investigation on October 9 and confirmed that some devices sold by CryptoBilis had been tampered with.
Yesterday, Ledger’s Donjon security arm shared more details about the hardware implant found inside devices from the reseller , largely confirming earlier reports by Mark Karpelès and Tibane Labs.
Donjon said the implant’s microcontroller detects and decodes the 24-word recovery phrase for setting up and restoring the wallet, then transmits it over LTE using a provisioned eSIM.
The implant is a separate component that does not modify the Secure Element or Ledger operating system, or alter transactions or signatures, which makes it undetectable by Ledger’s integrity self-checks.
More implants discovered
Ledger says all confirmed fund losses involve devices sold by Southeast Asian reseller CryptoBilis, but users have also reported compromised devices purchased from other sellers across Asia and Europe.
Some users reported buying modified wallets from a Metapod tech retailer at an airport in Singapore and via MediaMarkt in Europe.
MediaMarkt, which gets Ledger devices from distributor Aqipa GmbH, has now pulled the product from its shelves after these reports.
Ledger has now ordered a broader sales halt covering all distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong until investigations into device safety are complete.
The company reminded users that its infrastructure, systems, services, and direct sales channel are safe to use.
Trezor reduces reseller network
Trezor, another major cryptocurrency hardware wallet vendor, announced plans to reduce its reseller network to strengthen oversight and prevent supply-chain attacks.
“Supply-chain security is never finished, so we are raising the bar for every partner who continues with Trezor, with an updated legal framework and closer checks on how devices are sourced, stored, and handled,” Trezor said.
Trezor said it has found no evidence that its devices were compromised but decided to act swiftly as a precaution.
In a letter to affected resellers, the company said their partnerships would end on January 1, 2027, when their authorization to sell Trezor devices will be revoked.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.