Ledger asks sellers across Asia to halt sales after supply-chain attack
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents.
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents.
The company announced the decision in response to discovering that devices purchased from CryptoBilis had been modified to steal seed phrases used to access crypto assets and send them to an unauthorized party over an LTE connection.
Ledger sells physical cryptocurrency wallets that securely store private keys used for managing and authorizing digital asset transactions.
Following reports of cryptocurrency losses from multiple users, Ledger launched an investigation on October 9 and confirmed that some devices sold by CryptoBilis had been tampered with.
Yesterday, Ledger’s Donjon security arm shared more details about the hardware implant found inside devices from the reseller , largely confirming earlier reports by Mark Karpelès and Tibane Labs.
Ledger says all confirmed fund losses involve devices sold by Southeast Asian reseller CryptoBilis, but users have also reported compromised devices purchased from other sellers across Asia and Europe.
The implant is a separate component that does not modify the Secure Element or Ledger operating system, or alter transactions or signatures, which makes it undetectable by Ledger’s integrity self-checks.
Some users reported buying modified wallets from a Metapod tech retailer at an airport in Singapore and via MediaMarkt in Europe .
In a letter to affected resellers, the company said their partnerships would end on January 1, 2027, when their authorization to sell Trezor devices will be revoked.
Donjon said the implant’s microcontroller detects and decodes the 24-word recovery phrase for setting up and restoring the wallet, then transmits it over LTE using a provisioned eSIM.
MediaMarkt, which gets Ledger devices from distributor Aqipa GmbH, has now pulled the product from its shelves after these reports.
The company reminded users that its infrastructure, systems, services, and direct sales channel are safe to use.
Trezor, another major cryptocurrency hardware wallet vendor, announced plans to reduce its reseller network to strengthen oversight and prevent supply-chain attacks.
Ledger has now ordered a broader sales halt covering all distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong until investigations into device safety are complete.
What happened
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents.
The company announced the decision in response to discovering that devices purchased from CryptoBilis had been modified to steal seed phrases used to access crypto assets and send them to an unauthorized party over an LTE connection.
Ledger sells physical cryptocurrency wallets that securely store private keys used for managing and authorizing digital asset transactions.
What changed
Following reports of cryptocurrency losses from multiple users, Ledger launched an investigation on October 9 and confirmed that some devices sold by CryptoBilis had been tampered with.
Yesterday, Ledger’s Donjon security arm shared more details about the hardware implant found inside devices from the reseller , largely confirming earlier reports by Mark Karpelès and Tibane Labs.
Ledger says all confirmed fund losses involve devices sold by Southeast Asian reseller CryptoBilis, but users have also reported compromised devices purchased from other sellers across Asia and Europe.
Who is affected
The implant is a separate component that does not modify the Secure Element or Ledger operating system, or alter transactions or signatures, which makes it undetectable by Ledger’s integrity self-checks.
Some users reported buying modified wallets from a Metapod tech retailer at an airport in Singapore and via MediaMarkt in Europe .
Why it matters
In a letter to affected resellers, the company said their partnerships would end on January 1, 2027, when their authorization to sell Trezor devices will be revoked.
Donjon said the implant’s microcontroller detects and decodes the 24-word recovery phrase for setting up and restoring the wallet, then transmits it over LTE using a provisioned eSIM.
Technical details
MediaMarkt, which gets Ledger devices from distributor Aqipa GmbH, has now pulled the product from its shelves after these reports.
The company reminded users that its infrastructure, systems, services, and direct sales channel are safe to use.
Trezor, another major cryptocurrency hardware wallet vendor, announced plans to reduce its reseller network to strengthen oversight and prevent supply-chain attacks.
Response
Ledger has now ordered a broader sales halt covering all distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong until investigations into device safety are complete.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
What security teams should do
Trezor said it has found no evidence that its devices were compromised but decided to act swiftly as a precaution.
Attribution
BleepingComputer: Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents.
What to watch next
Watch for revised vendor guidance, fixed versions and mitigation updates.