Cryptocurrency hardware wallet manufacturer Ledger has ordered resellers and distributors across seven Asian markets to suspend sales after investigators discovered devices containing hidden electronic implants capable of stealing users’ wallet recovery phrases. The investigation follows reports of more than $86 million in suspected cryptocurrency thefts involving Bitcoin, Ethereum and Tron. Ledger has confirmed that some devices were physically tampered with but has not independently verified the total financial losses or number of affected customers.
Ledger Pulls Hardware Wallets From Seven Asian Markets
Ledger, the French company known for its cryptocurrency hardware wallets, announced on October 13 that distributors and resellers in Southeast Asia and Hong Kong must temporarily remove its devices from sale.
The suspension covers seven markets:
Indonesia, Singapore and Thailand
The Philippines and Vietnam
Malaysia and Hong Kong
The company is investigating how unauthorized hardware modifications entered its distribution network.
Ledger said all confirmed incidents involving stolen funds remain connected to devices sold through CryptoBilis, a reseller operating in Southeast Asia.
However, the company has not determined exactly who modified the devices or when the tampering occurred.
Hidden Chips Steal 24-Word Crypto Recovery Phrases
Ledger’s internal security research team, Donjon, discovered an unauthorized electronic implant inside an affected hardware wallet.
The implant was designed to capture the 24-word recovery phrase displayed on the device’s screen during its initial setup.
The recovery phrase is the master backup that allows someone to restore a cryptocurrency wallet and control its assets.
According to Ledger’s investigation, the malicious hardware operates through several components:
Hidden microcontroller: Reads information displayed on the wallet’s screen.
LTE cellular connection: Transmits stolen information to attackers.
Embedded eSIM: Allows the implant to communicate without using the owner’s computer or Wi-Fi connection.
Once attackers obtain a wallet’s recovery phrase, they can potentially restore that wallet elsewhere and transfer its cryptocurrency without the owner’s authorization.
Importantly, Ledger said the implant does not need to modify the device’s Secure Element, operating system or transaction-signing software.
Instead, the attack targets the recovery phrase before the owner has an opportunity to secure their funds.
Investigators Trace More Than $86 Million in Suspected Losses
Blockchain investigator Specter has traced more than $86 million in suspected cryptocurrency thefts associated with the incident.
The investigation reportedly involves transactions across multiple blockchain networks, including Bitcoin, Ethereum and Tron.
However, Ledger has emphasized that these figures are third-party estimates.
Several important details remain unconfirmed:
The exact amount of cryptocurrency stolen
The total number of affected customers
How many compromised devices entered circulation
Who manufactured or installed the implants
Where in the distribution process the tampering occurred
The company has confirmed the presence of an unauthorized implant in at least one affected device but has not independently verified the full scope of the suspected thefts.
German Retailer MediaMarkt Also Suspends Ledger Sales
The investigation has expanded beyond Southeast Asia.
European electronics retailer MediaMarkt Saturn suspended Ledger hardware wallet sales in its physical stores and online after a customer in Germany reported discovering a suspicious implant.
Ledger agreed to the sales suspension while the device was investigated.
The company said no cryptocurrency losses were reported in the German incident.
Ledger also stated that it has not verified any fund-draining incident involving a device purchased outside Southeast Asia.
The German discovery nevertheless raises additional questions about the security of hardware wallets moving through third-party retail distribution channels.
Ledger Says Its Internal Systems Were Not Compromised
Ledger has emphasized that the incident appears to involve physical tampering within the supply chain, rather than a breach of its internal technology.
The company reported no evidence that its:
Internal infrastructure or computer systems
Ledger operating system or Secure Element technology
Official direct-sales channel
had been compromised.
That distinction is significant because hardware wallets are designed to protect cryptocurrency private keys from remote attacks.
In this case, the attackers allegedly bypassed those protections by modifying the physical device before it reached the customer.
The investigation highlights a different security risk: even a legitimate hardware wallet can become dangerous if malicious components are installed before its initial setup.
Ledger Warns Customers to Protect Their Cryptocurrency
Ledger has issued specific guidance to customers who purchased devices from CryptoBilis.
Customers who have not activated their devices should avoid setting them up and contact Ledger Support.
Customers who already initialized a potentially affected wallet should consider transferring their cryptocurrency to a new, trusted device using a completely new recovery phrase.
Additional precautions include:
Never enter a recovery phrase into an unfamiliar website or application.
Avoid restoring a potentially compromised recovery phrase on another device.
Verify support instructions through Ledger’s official website.
Contact Ledger Support before attempting to open or physically inspect a suspicious device.
Ledger has also warned that scammers may exploit the incident by impersonating customer support representatives.
The company says it will never ask users to disclose their recovery phrases.
Trezor Tightens Reseller Policies Following Ledger Investigation
The security concerns are also affecting competing hardware wallet manufacturers.
Trezor, another major cryptocurrency hardware wallet provider, announced that it plans to discontinue authorized reseller arrangements beginning January 1, 2027, as a precautionary measure.
Trezor emphasized that it has no evidence its own devices were compromised.
The decision reflects growing concerns about the security risks associated with distributing cryptocurrency storage devices through third-party retailers.
Hardware Wallet Security Faces a Major Supply Chain Test
Hardware wallets are widely considered one of the more secure methods for storing cryptocurrency because private keys are designed to remain isolated from internet-connected devices.
However, the Ledger investigation demonstrates that hardware security depends on more than encryption and software protections.
It also depends on ensuring devices have not been physically altered before reaching customers.
The suspected thefts could encourage manufacturers to introduce stronger anti-tampering protections, more restrictive reseller programs and additional device authenticity checks.
