started · updated
Ledger investigates hardware wallet supply chain attack
Ledger is investigating a major supply chain attack involving unauthorized hardware implants in its cryptocurrency wallets. The company has requested distributors in Southeast Asia—including Indonesia, Singapore, Thailand, the Philippines, Vietnam, and Malaysia—as well as Hong Kong, to suspend sales and remove products from shelves.
Investigations revealed that devices sold through the reseller CryptoBilis contained a malicious component capable of capturing a user’s 24-word recovery phrase and transmitting it via an LTE connection using a provisioned eSIM. While Ledger stated that confirmed fund losses are currently limited to Southeast Asia, on-chain researchers estimate total damages could range between $72 million and $93 million across hundreds of wallets.
The incident has also impacted Europe, where the retailer MediaMarktSaturn suspended sales of Ledger devices following reports of potential tampering in Germany. Ledger clarified that no funds have been reported lost in relation to the German incidents and emphasized that the issue is a supply chain compromise rather than a breach of Ledger’s internal systems or infrastructure.
In response to the broader security concerns, competitor Trezor announced it is reducing its number of authorized resellers as a preventive measure to strengthen supply chain oversight. Trezor stated there is no evidence that its own devices have been compromised.
Entities
CryptoBilis · Donjon · Germany · Hong Kong · Ledger · MediaMarktSaturn · Southeast Asia · Trezor
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 3 SOURCES] Bitquery estimates total damages at approximately 93 million dollars across 311 wallets. newsbit.nl · cryptonews.com.au · cryptoast.fr
- [● 5 SOURCES] Trezor is reducing its number of authorized resellers as a preventive measure to strengthen supply chain controls. journalducoin.com · exame.com · comparic.pl · blogtienao.com
- [DISPUTED] Confirmed incidents of hardware tampering are currently limited to Southeast Asia. newsbit.nl · blockzeit.com · www.btc-echo.de · phocapblockchain.net · cybernoz.com
- [● 10 SOURCES] Ledger has requested distributors in Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales. www.btc-echo.de · cryptoast.fr · www.morgenpost.de · dev.to · comparic.pl · +5 more
- [● 6 SOURCES] No loss of funds has been reported in relation to the reported tampering in Germany. newsbit.nl · blockzeit.com · cryptonews.com.au · phocapblockchain.net · blogtienao.com
- [● 9 SOURCES] An unauthorized hardware implant was found in devices sold by the reseller CryptoBilis. exame.com · dev.to · phocapblockchain.net · cybernoz.com · www.world-today-news.com · +2 more
- [● 5 SOURCES] The tampering is identified as a supply chain issue rather than a compromise of Ledger's internal systems or infrastructure. blockzeit.com · dev.to · phocapblockchain.net · cybernoz.com · blogtienao.com
- [DISPUTED] MediaMarktSaturn has suspended the sale of Ledger devices in its physical stores and online shops across Europe. newsbit.nl · blockzeit.com · cryptonews.com.au · www.upday.com · phocapblockchain.net · +1 more
- [● 5 SOURCES] Ledger confirmed that some devices sold by CryptoBilis had been tampered with. phocapblockchain.net · cybernoz.com · newsbit.nl · cryptonews.com.au · www.spacemoney.com.br
- [● 4 SOURCES] The hardware implant can capture a 24-word recovery phrase and transmit it via LTE/eSIM. phocapblockchain.net · cybernoz.com · www.spacemoney.com.br · cryptonews.com.au