Ledger asks sellers across Asia to halt sales after supply-chain attack

Ledger told every distributor in Southeast Asia and Hong Kong to stop selling its wallets and remove products from shelves. The pause matters because some devices from resellers had been modified before reaching customers, creating a supply-chain security risk.

The order covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. It followed confirmed fund losses involving devices sold by Southeast Asian reseller CryptoBilis, plus reports of compromised wallets from other sellers.

Ledger said its infrastructure, services, systems, and direct sales channel remain safe to use. The broader halt will continue while the company investigates device safety and determines whether more wallets were tampered with.

A hardware implant is an added physical component placed inside a device without the owner’s knowledge. It matters because the product can look genuine while containing extra hardware designed to steal sensitive information.

Donjon found a separate microcontroller inside some Ledger wallets sold by CryptoBilis. The component detected and decoded the 24-word recovery phrase used to set up or restore a wallet. It then transmitted the phrase through LTE using a provisioned eSIM.

The implant did not change Ledger’s Secure Element, operating system, transactions, or signatures. That separation helped it avoid Ledger’s normal integrity self-checks. The incident shows that a secure product can still be compromised before sale if its physical supply chain is not controlled closely.

The known impact extends beyond one confirmed reseller, although Ledger identified a clear link in the actual fund losses. Every confirmed loss involved devices sold by Southeast Asian reseller CryptoBilis, according to Ledger.

Users also reported compromised wallets purchased from Metapod, including at a technology retailer in an airport in Singapore. Other reports involved MediaMarkt in Europe, which obtained Ledger devices from distributor Aqipa GmbH. MediaMarkt subsequently removed the products from its shelves.

Ledger ordered a wider sales halt across Southeast Asia and Hong Kong while investigations continue. The reports do not establish that every device from these sellers was compromised. They show instead that suspected tampering appeared across multiple sales channels and regions, making distributor and retailer oversight central to the response.

The recovery phrase is created when a wallet is set up and is also used when restoring one. Ledger’s Donjon security team said the implanted hardware was built to capture this phrase because it can be used to access the wallet’s crypto assets.

Inside affected devices, a microcontroller detected and decoded all 24 words. The implant then used LTE to transmit the captured phrase, with a provisioned eSIM supplying the cellular connection. The data went to an unauthorized party.

This method did not require changing a transaction or forging a signature. Instead, it targeted the phrase that controls access to the wallet. Ledger said confirmed fund losses involved devices sold by CryptoBilis. Users with suspected devices face a serious risk because exposure of the phrase can allow unauthorized access to their cryptocurrency.

Ledger’s integrity checks were designed to examine the wallet’s recognized security components and software. The hidden hardware sat outside those areas, so the device could pass its normal checks despite containing a malicious addition.

Donjon said the implant did not modify the Secure Element or Ledger operating system. It also did not alter transactions or signatures. Instead, its separate microcontroller watched for the 24-word recovery phrase and prepared it for transmission over LTE.

That design made the tampering difficult for Ledger’s built-in checks to detect. The incident highlights a gap between verifying software and core security hardware and verifying every physical component added during distribution or handling. Ledger therefore ordered a wider sales halt while it investigates devices from several sellers and regions.

A wallet’s recovery phrase is used to set up or restore access to the wallet. If an unauthorized party obtains it, that party may be able to access the associated crypto assets and authorize transfers away from the user.

That risk explains the losses linked to the incident. Donjon said the implant detected and decoded the 24-word phrase, then transmitted it over LTE. The article reports that multiple users lost cryptocurrency, and Ledger confirmed that all such losses involved devices sold by CryptoBilis.

The danger arises even when the wallet’s software and transaction signatures appear normal. The attacker does not need to alter the device’s operating system or the user’s visible transactions first. Possession of the phrase can provide the access needed to send assets elsewhere, making suspected tampering urgent.

A supply-chain attack targets the path a product takes before reaching its user. That path can include manufacturing, distributors, resellers, storage, transport, and retailers. It matters because attackers may compromise the product outside the company’s own systems.

The Ledger incident illustrates the risk. Devices sold by CryptoBilis contained a separate implant that captured recovery phrases and transmitted them over LTE. Reports also involved Metapod and MediaMarkt, whose Ledger products came through distributor Aqipa GmbH.

Trezor responded by reducing its reseller network and tightening checks on how devices are sourced, stored, and handled. It said it found no evidence that its devices were compromised. The broader lesson is that secure software and hardware need strong partner oversight throughout the sales chain.