This time, the problem wasn’t with Ledger’s servers. The device had been tampered with before it ever reached the user.
An investigation disclosed on October 9 found that a Ledger user who bought their device through Southeast Asian reseller CryptoBilis reported having their assets stolen. Independent investigators estimate that the amount involved could exceed $93 million. After taking the device apart, they found that at least one unit had been implanted with an unauthorized hardware module. It could read the 24-word recovery phrase as it appeared on the screen during device setup, then send it directly to the attackers through an LTE (eSIM) module. On October 13, Ledger asked resellers in seven markets—Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong—to suspend sales and pull their products from shelves. This was a clear expansion from its earlier warning, which named just one reseller.
Why is this worth thinking about carefully? Because the entire trust model of a hardware wallet rests on the assumption that “the private key never leaves the chip.” But this attack didn’t bypass cryptography; it exploited the supply chain: a third-party piece of hardware was inserted between the screen and the secure chip. Firmware signatures and open-source verification can’t stop it—it’s physically there, disguised as part of the factory-fresh device. Ledger stressed that its infrastructure, systems, and direct sales channels were not compromised. The problem was limited to third-party resale in specific regions, and the company has not verified any cases of theft involving devices bought elsewhere.
My take: a hardware wallet’s security boundary has never really been inside the chip. It’s the question of “where did you get it?” A cold wallet moves the attack surface from online to shipping and retail shelves—and that’s precisely the layer that’s hardest to audit. After all, all of someone’s $BTC and mainstream assets often sit inside a piece of metal no bigger than the palm of your hand. Two things remain to be seen: where in the distribution chain the tampering happened, and who carried it out; and whether Ledger Donjon’s analysis of recovered devices will uncover more affected batches.
So the question ultimately comes down to each crypto holder: would you rather save a few dollars and get your device sooner by buying from a local reseller, or wait for direct shipping from the official website and check the tamper-evident packaging yourself?
#Ledger asks resellers in Southeast Asia and Hong Kong to suspend sales
An investigation disclosed on October 9 found that a Ledger user who bought their device through Southeast Asian reseller CryptoBilis reported having their assets stolen. Independent investigators estimate that the amount involved could exceed $93 million. After taking the device apart, they found that at least one unit had been implanted with an unauthorized hardware module. It could read the 24-word recovery phrase as it appeared on the screen during device setup, then send it directly to the attackers through an LTE (eSIM) module. On October 13, Ledger asked resellers in seven markets—Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong—to suspend sales and pull their products from shelves. This was a clear expansion from its earlier warning, which named just one reseller.
Why is this worth thinking about carefully? Because the entire trust model of a hardware wallet rests on the assumption that “the private key never leaves the chip.” But this attack didn’t bypass cryptography; it exploited the supply chain: a third-party piece of hardware was inserted between the screen and the secure chip. Firmware signatures and open-source verification can’t stop it—it’s physically there, disguised as part of the factory-fresh device. Ledger stressed that its infrastructure, systems, and direct sales channels were not compromised. The problem was limited to third-party resale in specific regions, and the company has not verified any cases of theft involving devices bought elsewhere.
My take: a hardware wallet’s security boundary has never really been inside the chip. It’s the question of “where did you get it?” A cold wallet moves the attack surface from online to shipping and retail shelves—and that’s precisely the layer that’s hardest to audit. After all, all of someone’s $BTC and mainstream assets often sit inside a piece of metal no bigger than the palm of your hand. Two things remain to be seen: where in the distribution chain the tampering happened, and who carried it out; and whether Ledger Donjon’s analysis of recovered devices will uncover more affected batches.
So the question ultimately comes down to each crypto holder: would you rather save a few dollars and get your device sooner by buying from a local reseller, or wait for direct shipping from the official website and check the tamper-evident packaging yourself?
#Ledger asks resellers in Southeast Asia and Hong Kong to suspend sales
