Ledger hardware wallets compromised via physical supply chain tampering

Security researchers at Ledger’s Donjon team have identified a physical supply chain attack affecting certain hardware wallets. Unauthorized electronic components were found embedded in devices distributed through the Southeast Asian retailer CryptoBilis. These components were designed to intercept the 24-word recovery phrase displayed on the screen during initial setup and transmit it to external actors via LTE communication using an integrated eSIM.

Ledger clarified that this is not a breach of their Secure Element or operating system, but rather a physical modification of legitimate hardware during the distribution process. While on-chain investigators estimate losses exceeding $86 million, Ledger has not officially confirmed this total. In response, the company has requested temporary sales suspensions from authorized distributors in Southeast Asia and Hong Kong.

The incident has reignited industry debates regarding self-custody. While Ledger focuses on securing its supply chain, recent vulnerabilities in other hardware wallets, such as Coldcard’s firmware flaws, have further highlighted the complexities and risks associated with managing private keys independently.