Timeline
- 7.5
Karpelès Reports Ledger Implants in Devices From Two More Resellers
Karpelès reported discovering malicious implants in Ledger hardware wallet devices supplied by two additional resellers, extending reported supply-chain tampering beyond the reseller previously implicated. If tampering extends beyond a single distribution channel, users who bought Ledger devices through third-party resellers rather than directly from the manufacturer face exposure, since an implant can capture recovery phrases during wallet setup. Earlier reports tied the implants to devices distributed by CryptoBilis, a Southeast Asian reseller, with on-chain analysis estimating roughly $93 million drained from 311 wallets after seed phrases were captured during setup. Karpelès had previously flagged implant warnings months before the wider security crisis drew attention.
- 7.5
Scammer loses $4.8M stored on tampered Ledgers: Asia Express
Ledger suspended its reseller network across South East Asia after thieves stole more than $103.4 million from 530 addresses using tampered Ledger devices inserted into the supply chain. Chainalysis reported that one of the affected holders was itself a task scammer who lost 60 Bitcoin (about $4.8 million) after buying three new Ledgers containing spyware that records seed phrases. Ledger has asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to remove its devices from sale, meaning buyers in those markets lose the local reseller channel while the tampering is investigated. Trezor also decided to shut some of its more far-flung resellers from Jan. 1, saying it cannot guarantee the same level of vigilance it applies closer to home. Ledger insists that all confirmed thefts to date are from Asia, even though reports of tampered Ledgers in Europe prompted electronics retailer MediaMarkt to suspend sales. The roundup also notes that South Korea's Financial Intelligence Unit approved measures to block domestic access to 27 websites of unregistered exchanges and other virtual asset service providers including KuCoin, MEXC, Phemex and Bitrue, and that Thailand's SEC finalized rules allowing Bitcoin and Ether ETFs to begin trading Friday.
- 7.5
Ledger asks distributors in six Southeast Asian countries and Hong Kong to stop selling hardware wallets amid tampering investigation
Ledger asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and take its hardware wallets off the shelves while it investigates suspected device tampering, the company said in a post on X on Tuesday. The request expands earlier stop-sale and shipment-suspension measures against regional reseller CryptoBilis, an investigation made public on Oct 9. The move removes Ledger devices from retail shelves across a region and puts the integrity of the hardware-wallet supply chain, a core assumption of self-custody, under scrutiny. In Germany, MediaMarkt Saturn stopped selling Ledger devices in stores and online with Ledger's agreement after a customer reported an implant, though no funds were lost. Ledger's Donjon security team found the implant reads the 24-word recovery phrase from the device's screen during setup and sends it out over LTE; anyone holding that phrase can restore the wallet and move its funds. Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger says it has not verified.
- 8.5
Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets
Trezor has told partners in its authorized reseller network that their authorization ends on January 1, 2027, and that it will ship them no new stock, days after rival Ledger's Donjon security team confirmed a hidden spy implant in hardware wallets sold by Southeast Asian reseller CryptoBilis. Trezor said there is "not a single piece of evidence" its own devices were compromised and described the cut as a precaution. The Ledger finding is a confirmed supply-chain compromise of seed-phrase handling in widely used hardware wallets, and Trezor's decision shows the incident is already reshaping how wallet makers manage third-party distribution. Ledger says the CryptoBilis implant reads the screen and decodes the recovery phrase when it appears, then sends it out over LTE via an eSIM, without altering the key-storage chip or the operating system, so a tampered wallet looks and works normally. Onchain investigator Specter traced more than $86 million in suspected thefts, a figure Ledger says it has not verified; Trezor has not said how many resellers are affected, and those cut can keep selling existing stock through the holiday season.
- 8.0
Ledger User Reports Hardware Implant in Wallet Bought in Europe
User @0xJohannes reported that a Ledger hardware wallet bought weeks earlier from a European authorised reseller contained an unauthorised implant, with suspicious wiring that genuine Ledger devices do not have, indicating the device may have been physically tampered with before sale. Funds held on the affected device have not been stolen, and suspected cases have also been reported in Asia and South America. The report raises the possibility that the tampering scheme first disclosed on October 9 is not confined to the Southeast Asian reseller CryptoBilis that Ledger has identified, which is a concern for self-custody users who assume devices bought through normal retail channels are genuine. According to the user account, Ledger's Genuine Check cannot detect unauthorised physical modification when the original secure element remains intact. Ledger maintains that all confirmed fund-draining cases in its October 9 investigation involve CryptoBilis, a reseller in Indonesia, Malaysia and the Philippines, which has halted hardware-wallet sales. The reported implant appears to be an older version; newer variants typically conceal components behind the screen.
- 8.0
Ledger Says Affected User’s Device Contained Hardware Implant
Ledger has confirmed that an affected user's device contained a hardware implant, and reseller CryptoBilis has halted sales of its entire hardware wallet inventory — across all brands — pending the investigation. The move widens an earlier pause request that had been limited to Ledger devices. A confirmed implant inside a Ledger device sold through a reseller is a supply-chain compromise of a widely used self-custody product, directly putting recovery phrases and user funds at risk. Ledger has advised buyers from the past 90 days not to set up their devices and, if already set up, to consider moving assets to a new signer. Blockchain analytics firm Bitquery reported the incident drained $93.2 million from 315 wallets across six chains. CryptoBilis has suspended sales and shipments across all stores and online channels in Malaysia, the Philippines and Indonesia and closed its physical stores until further notice; company records show a 100% ownership change effective August 3 to a person named Jiaming with a registered address in Heilongjiang, China, after a March acquisition, though no evidence links the ownership change to the wallet thefts.