Ledger Halts Wallet Sales Across Southeast Asia After Hardware Tampering

The Ledger supply-chain attack has prompted the cryptocurrency wallet maker to ask distributors and resellers across Southeast Asia and Hong Kong to suspend sales. The company also wants sellers to remove devices from shelves while it investigates hardware tampering.

Investigators found modified wallets containing implants that capture recovery phrases and transmit them through an LTE connection. Those phrases can give attackers access to the cryptocurrency secured by an affected wallet.

Investigation Links Confirmed Losses to CryptoBilis Devices

Ledger began investigating on October 9 after several users reported cryptocurrency losses. It subsequently confirmed tampering in some devices sold by Southeast Asian reseller CryptoBilis.

The company makes hardware wallets that store private keys used to authorize cryptocurrency transactions. However, the implants target the recovery phrase rather than changing the wallet’s transaction-signing process.

According to Ledger, all confirmed fund losses involve devices purchased from CryptoBilis. Reports concerning other retailers have nevertheless widened concerns about the distribution chain.

Hardware Implants Send Recovery Phrases Over LTE

Ledger’s Donjon security team explained that the implant contains a microcontroller capable of detecting and decoding the wallet’s 24-word recovery phrase.

This phrase allows an owner to restore access to their wallet. Consequently, anyone who obtains it may also gain control of the associated assets.

After capturing the phrase, the implant transmits it over LTE using a provisioned eSIM.

Crucially, the malicious hardware operates as a separate component. It does not modify Ledger’s Secure Element or operating system, nor does it change transactions or signatures.

As a result, Ledger’s existing integrity self-checks cannot detect this type of implant. A device can therefore pass those checks despite containing additional hardware designed to steal its recovery phrase.

Reports Extend Beyond the Initially Identified Reseller

Users have also reported modified wallets purchased through other sellers in Asia and Europe.

These reports include purchases from a Metapod technology shop at a Singapore airport and through MediaMarkt in Europe. However, reports of compromised devices remain distinct from Ledger’s confirmed findings about cryptocurrency losses.

MediaMarkt, which obtains Ledger products through distributor Aqipa GmbH, has removed the devices from its shelves following the reports.

Meanwhile, Ledger has expanded its sales suspension beyond the reseller initially linked to the investigation.

Ledger Supply-Chain Attack Prompts Regional Sales Suspension

The broader halt covers distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

Ledger has asked sellers to stop sales until investigations into device safety conclude. The move aims to prevent further distribution while the company examines the affected supply chain.

At the same time, Ledger says its infrastructure, systems, services and direct sales channel remain safe to use.

That assurance concerns the company’s own operations. The ongoing investigation focuses on physical tampering involving devices sold through third-party channels.

Trezor Tightens Oversight of Its Reseller Network

Separately, hardware wallet manufacturer Trezor has announced plans to reduce its reseller network as a precaution against supply-chain attacks.

The company says it has found no evidence of compromised Trezor devices. Nevertheless, it plans to strengthen partner requirements and increase scrutiny of how sellers source, store and handle wallets.

Its changes include an updated legal framework and closer oversight of remaining partners.

In letters to affected resellers, Trezor said their partnerships would end on January 1, 2027. Their authorization to sell Trezor devices will expire on that date.