Ledger Halts Wallet Sales Across Parts of Asia After Hardware Implants Steal Recovery Phrases
Summary
Ledger confirmed that modified wallets sold through resellers contained LTE-connected implants that stole recovery phrases. It ordered a sales halt across Southeast Asia and Hong Kong while investigating; Trezor is also tightening reseller oversight.
Key points
- Ledger confirmed that some wallets sold by Southeast Asian reseller CryptoBilis were tampered with after users reported cryptocurrency losses.
- The implant decodes the wallet’s 24-word recovery phrase and sends it over LTE using a provisioned eSIM.
- The implant is separate from the Secure Element and Ledger operating system, allowing it to evade Ledger’s integrity self-checks.
- Ledger says confirmed fund losses involve CryptoBilis devices, while users have also reported compromised wallets from other sellers in Asia and Europe.
- MediaMarkt pulled Ledger products from its shelves after reports of modified devices purchased through its stores.
- Ledger ordered distributors in Southeast Asia and Hong Kong to halt sales pending its investigation.
- Trezor said it found no evidence its devices were compromised but plans to end some reseller partnerships on January 1, 2027, and strengthen partner checks.
Article Details
- Victim Organization
- Ledger
- Incident Type
- Supply-chain attack involving hardware implants in Ledger wallets that captured recovery phrases and transmitted them over LTE to an unauthorized party.
- Data Types Exposed
- 24-word wallet recovery phrases (seed phrases)
- Operational Impact
- Ledger confirmed that some devices sold by CryptoBilis had been tampered with. Multiple users reported cryptocurrency losses, and Ledger ordered distributors in Southeast Asia and Hong Kong to halt sales while it investigates. Ledger said its integrity self-checks do not detect the implant.
- Claim Status
- confirmed
People
Vendors
Products
Countries
IndonesiaLedger has now ordered a broader sales halt covering all distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong until investigations into device safety areMalaysiacovering all distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong until investigations into device safety are complete.Philippinesa broader sales halt covering all distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong until investigations into device safety are complete.SingaporeSome users reported buying modified wallets from a Metapod tech retailer at an airport in Singapore and via MediaMarkt in Europe.Thailandhas now ordered a broader sales halt covering all distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong until investigations into device safety are complete.Vietnamsales halt covering all distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong until investigations into device safety are complete.