"Supply-chain security is never finished, so we are raising the bar for every partner who continues with Trezor, with an updated legal framework and closer checks on how devices are sourced, stored, and handled," Trezor said.
What Ledger found in devices sold by CryptoBilis
Ledger announced it opened an investigation on October 9 after reports of cryptocurrency losses from multiple users. The company said devices purchased from Southeast Asian reseller CryptoBilis had been modified to steal the 24‑word recovery phrases used to access crypto assets and send them to an unauthorized party over an LTE connection. Ledger has linked all confirmed fund losses to devices sold by CryptoBilis, and it asked resellers and distributors in Southeast Asia and Hong Kong to halt sales and remove products from shelves while the investigation continues.
How the implant operates, according to Ledger’s Donjon security arm
Ledger’s Donjon security group provided technical detail on the modification. Donjon said the implant contains a microcontroller that detects and decodes the wallet’s 24‑word recovery phrase during setup or restoration. The implant then transmits that phrase over LTE using a provisioned eSIM. Crucially, Donjon said the implant is a separate hardware component that does not modify the Secure Element or the Ledger operating system and does not alter transactions or signatures — attributes that make it undetectable by Ledger’s integrity self‑checks.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildReports of compromised purchases beyond CryptoBilis
Although Ledger tied confirmed losses to CryptoBilis, users have reported compromised wallets purchased from other sellers across Asia and Europe. Some users said they bought modified devices from a Metapod tech retailer at an airport in Singapore and others reported purchases via MediaMarkt in Europe. MediaMarkt, which obtains Ledger devices from distributor Aqipa GmbH, has pulled the product from its shelves following those reports.
Ledger’s immediate actions and user guidance
Ledger ordered a broader sales halt covering all distributors in Southeast Asia — naming Indonesia, Singapore, Thailand, the Philippines, Vietnam, and Malaysia — and Hong Kong until investigations into device safety are complete. The company emphasized that its infrastructure, systems, services, and direct sales channel are safe to use, directing users who rely on its official channels for purchase and support to continue there while offline retail stocks are examined.
Trezor’s response: tighten reseller oversight and revoke authorizations
Separately, hardware wallet vendor Trezor said it has found no evidence that its devices were compromised but announced plans to reduce its reseller network and strengthen oversight to help prevent supply‑chain attacks. In a statement quoted above, Trezor said it is imposing an updated legal framework and closer checks on how devices are sourced, stored, and handled. The company told affected resellers that their partnerships will end on January 1, 2027, when their authorization to sell Trezor devices will be revoked.
What this means for end users, resellers and retailers, and other wallet vendors
- End users: Those who purchased devices through resellers in the affected regions will need to treat their devices as potentially compromised until investigations conclude; Ledger has pointed users to its direct sales channel and services as safe alternatives.
- Resellers and retailers (including MediaMarkt, Metapod, Aqipa GmbH): Retailers are facing product pulls and paused sales; distributors named in the halt will have to accommodate Ledger’s investigation and potential inventory audits.
- Other wallet vendors (exemplified by Trezor): Vendors are revising reseller policies and legal frameworks, with at least one company preemptively revoking reseller authorizations to tighten supply‑chain controls.
The incident puts a narrow but stark spotlight on physical‑supply‑chain risk: a separate, undetectable hardware implant can bypass software integrity checks and convert the single weak point in many cold‑storage workflows — the 24‑word recovery phrase — into an exfiltration vector. Ledger’s sales halt across Southeast Asia and Hong Kong, MediaMarkt’s pull from shelves, and Trezor’s reseller changes are concrete moves while the technical and commercial investigations proceed. Whether other sellers’ reports of compromised devices will broaden the footprint of the issue is the immediate question investigators must answer before shelves are restocked and reseller networks are trusted again.
