- Trending
- Comments
- Latest
Ledger has asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to stop selling its hardware wallets and pull existing stock, widening a probe into devices fitted with an unauthorized hardware implant.
The implant allegedly captured 24-word recovery phrases during setup and sent them to attackers over a cellular connection. Independent investigators estimate losses of up to $93.4 million, a figure Ledger has not confirmed.
The investigation became public on October 9 after users reported cryptocurrency losses involving Ledger devices purchased through CryptoBilis. The suspected losses have since attracted considerable attention from blockchain investigators, with independent estimates reaching as high as $93.4 million. Ledger has not independently confirmed that total, and the precise number of affected customers remains uncertain.
On October 10, the company confirmed that an affected device contained an unauthorized hardware implant. A subsequent technical explanation described how the component could capture the 24-word recovery phrase displayed on the screen during initial setup and transmit the information to attackers through a cellular connection using LTE and an embedded SIM, or eSIM.
A recovery phrase is effectively the master credential for a cryptocurrency wallet. Anyone who obtains it may be able to reconstruct the wallet on another device and transfer its assets without possessing the original hardware wallet.
According to Ledger’s investigation update, the implant did not modify the device’s Secure Element or operating system, nor did it alter transactions or digital signatures. Instead, the suspected attack exploited the physical device and its distribution chain to capture sensitive information.
That distinction makes the incident particularly concerning. Conventional software protections may remain intact even when unauthorized components inside a device compromise information displayed during setup.
The case has also raised questions about how resellers handle stock, verify product integrity and protect customers against hardware tampering. Ledger’s investigation is intended to determine who modified the devices and at what point the interference occurred.
The controversy has extended beyond Southeast Asia, although reports from other regions have not established that the same attack affected every device involved.
On October 13, European electronics retailer MediaMarktSaturn suspended sales of Ledger products in its stores and online platforms after a customer in Germany reported finding an unauthorized hardware implant. Ledger said no loss of funds had been reported in connection with that case.
Former Mt. Gox chief executive Mark Karpeles also reported a suspected implant in a Ledger Flex purchased at Singapore’s airport. The reported hardware included an antenna marked as an Eurasian version, but the allegation does not independently establish that the device was connected to the CryptoBilis-linked thefts.
Ledger has maintained that its confirmed fund-loss cases remain confined to Southeast Asia and that it has not verified a wallet drain involving a device purchased elsewhere. The wider reports nevertheless demonstrate why investigators must distinguish confirmed findings from allegations that still require technical verification.
Other hardware wallet providers have responded by reviewing their own distribution arrangements. Trezor, a competing manufacturer, announced plans to reduce its reseller network, with certain partnership changes scheduled to take effect on January 1, 2027. The company has said it has no evidence that its own devices were compromised.
These developments put renewed pressure on hardware wallet manufacturers to strengthen reseller oversight, product inspection and supply-chain accountability. Customers generally cannot determine whether a device has been modified simply by examining its packaging.
The immediate priority is protecting recovery credentials and preventing further losses. Ledger has advised customers who purchased devices through CryptoBilis within the past 90 days not to initialize unused units. Customers who have already configured their devices should transfer their assets to a new device using a newly generated recovery phrase.
Users should contact Ledger Support through its official website if they suspect their devices have been tampered with. Anyone who has lost funds should also consider reporting the incident to local law enforcement and preserving relevant evidence.
The company has warned that scammers may exploit the publicity surrounding the investigation to target worried customers with fake support calls, fraudulent recovery services and phishing messages.
“Ledger will never call you, message you directly or ask for your 24-word recovery phrase,” the company reiterated in its security warnings.
That message is particularly important because anyone who obtains a recovery phrase can potentially access the associated crypto assets. Users should never disclose the phrase to customer support representatives, enter it into websites or share it through messaging applications.
For now, the wider suspension of Ledger Wallets underscores a critical weakness in hardware security: protecting private keys is not enough if a device can be compromised before it reaches its owner.
The investigation must establish how the implants entered the supply chain, how many customers were affected and whether additional devices outside the confirmed cases were modified. Until those questions are answered, the incident is likely to keep attention focused on reseller oversight and the physical integrity of cryptocurrency storage devices.
Copyright © 2025 - The Bit Gazette.
