Ledger halts wallet sales in Asia after hardware implants

Ledger has told its resellers and distributors in Southeast Asia and Hong Kong to stop selling its cryptocurrency wallets and take stock off the shelves. The move follows the discovery of hardware implants in devices that steal the recovery phrases protecting users' crypto assets.

The company makes physical hardware wallets that keep the private keys used to manage and approve digital asset transactions. Those keys are meant to stay on the device. The tampered wallets were built to undo that protection.

How the investigation started

Several users reported losing cryptocurrency, and Ledger opened an investigation on October 9. It confirmed that some devices sold by CryptoBilis, a reseller in Southeast Asia, had been modified. The modified wallets captured users' seed phrases and sent them to an unauthorized party over an LTE mobile connection.

Ledger's in-house security team, Donjon, published further technical details about the implant yesterday. Its findings largely match earlier reports from Mark Karpelès and Tibane Labs.

What the implant does

According to Donjon, the implant has its own microcontroller. It detects and decodes the 24-word recovery phrase that users write down when they set up or restore a wallet. It then sends that phrase out over LTE through an eSIM that has already been provisioned.

The implant is a separate piece of hardware. It does not touch the Secure Element, the protected chip that holds the keys, and it does not change the Ledger operating system. It also leaves transactions and signatures unaltered. Because of this, Ledger's own integrity self-checks cannot detect it. A wallet with the implant inside can look and behave like a normal device while quietly leaking the one secret that gives full access to the funds.

Reports from other sellers

So far, every confirmed loss of funds involves a device bought from CryptoBilis. Users, however, have also described compromised wallets bought from other sellers in Asia and Europe.

Some said they bought modified devices from a Metapod tech retailer at an airport in Singapore. Others pointed to MediaMarkt, an electronics retailer in Europe. MediaMarkt sources its Ledger devices from the distributor Aqipa GmbH and has now removed the product from its shelves following these reports.

Ledger then widened its response. The sales halt now covers all distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. It stays in place until the company finishes checking whether devices in those markets are safe.

The company stressed that its infrastructure, systems and services are not affected, and that buying directly from Ledger remains safe.

Trezor cuts back its resellers

Trezor, another large maker of hardware wallets, said it will shrink its reseller network to tighten oversight and lower the risk of supply-chain attacks.

"Supply-chain security is never finished, so we are raising the bar for every partner who continues with Trezor, with an updated legal framework and closer checks on how devices are sourced, stored, and handled," the company said.

Trezor said it has found no evidence that its own devices were compromised and is acting as a precaution. In a letter to the affected resellers, it said their partnerships will end on January 1, 2027. From that date they will no longer be authorized to sell Trezor devices.

Our Take

For anyone holding crypto, the main lesson is simple: where you buy a hardware wallet matters as much as which wallet you buy. This attack did not break Ledger's cryptography or its software. It added a component that sits outside everything the device checks. That suggests software-based integrity checks alone cannot rule out physical tampering once a device has passed through untrusted hands.

The case fits a wider pattern of attackers going after the path a product takes to the customer rather than the product itself. We have seen the same idea with cheap Android phones shipping with ad-fraud malware and with poisoned code packages such as the MALFEX npm campaign. The goal is also familiar from other crypto theft methods, including SIM-swap attacks: get the secret that unlocks the funds.

Readers who bought a Ledger device from one of the named sellers would be well advised to follow Ledger's guidance closely. It is worth watching whether the investigation confirms losses tied to sellers other than CryptoBilis, how far the implants spread in Europe, and whether other wallet makers follow Trezor in cutting back their reseller networks.