A chip hidden inside a wallet’s casing. All it takes is one glance at the screen while setting up the device: 24 words are sent over a mobile network, and $86 million may have vanished as a result 🦖
⚡ 有大动静群里说
On October 13, hardware wallet giant Ledger asked distributors in six countries—Indonesia, Singapore, Thailand, the Philippines, Vietnam, and Malaysia—as well as Hong Kong, to stop selling its products and remove all devices from store shelves. The reason: Ledger confirmed that a device had been tampered with ⚠️
The most insidious thing about this chip is that it doesn’t touch the firmware or the security chip that stores the keys. It does just one thing: spy on the screen during setup. When the 24-word recovery phrase appears, it decodes the words and sends them out over an LTE network using a built-in eSIM. In other words, the device’s appearance, packaging, and signature verification all look normal. You’d never know 🔐
It started on October 9, when a problem was reported with devices sold by Southeast Asian distributor CryptoBilis. On October 10, Ledger officially confirmed that one device had been compromised. On-chain investigator Specter traced suspected thefts totaling more than $86 million across Ethereum, Tron, and Bitcoin. Two other researchers estimated the figure at between $72 million and $86 million. But Ledger stressed that it has yet to verify the number of people affected or the total losses.
The fallout has spread across the industry. European electronics retail giant MediaMarkt announced that it would remove all Ledger products from its physical stores and online platforms. Competitor Trezor also announced on October 13 that it would reduce its network of authorized distributors, effective January 1, 2027, and immediately stop supplying those channels. It emphasized that there is no evidence its own devices have been compromised; the move is a response to recent supply-chain incidents 💥
My take: this incident didn’t pierce the encryption—it exposed the final link in the hardware wallet business model: distribution. The industry has long said hardware wallets are the safest option because the keys stay offline and you get the device directly from an authorized source. But this incident shows exactly the opposite: if someone can tamper with a distributor, the device in your hands could look brand-new, have intact packaging, and run clean firmware—and still be a device with a spy inside.
The bigger problem is that you can’t prove the device is clean using conventional methods. You can verify a firmware change with a signature, and check a chip’s serial number. But an independent add-on that only reads the screen and sends a message leaves the device working as usual. That’s why Ledger’s only response has been to halt sales across the entire region: even Ledger doesn’t yet know at which point in the distribution chain the chip was planted.
For everyday crypto holders, there are three things worth watching next: First, will the investigation extend to markets outside Southeast Asia? Second, will tighter controls on distribution force more people to buy hardware wallets directly from manufacturers? Third, will multisig go from an institutional setup to a standard for individuals? Using devices from different manufacturers to create a multisig wallet means that even if one device is compromised, the funds can’t be moved.
Let’s discuss in the comments: Did you buy your hardware wallet from an official source or a third party? What do you check after unboxing it?
Every day, I bring you the latest from the crypto world—not just what’s happening, but the logic and opportunities behind the headlines 👀🚀
⚡ 有大动静群里说
On October 13, hardware wallet giant Ledger asked distributors in six countries—Indonesia, Singapore, Thailand, the Philippines, Vietnam, and Malaysia—as well as Hong Kong, to stop selling its products and remove all devices from store shelves. The reason: Ledger confirmed that a device had been tampered with ⚠️
The most insidious thing about this chip is that it doesn’t touch the firmware or the security chip that stores the keys. It does just one thing: spy on the screen during setup. When the 24-word recovery phrase appears, it decodes the words and sends them out over an LTE network using a built-in eSIM. In other words, the device’s appearance, packaging, and signature verification all look normal. You’d never know 🔐
It started on October 9, when a problem was reported with devices sold by Southeast Asian distributor CryptoBilis. On October 10, Ledger officially confirmed that one device had been compromised. On-chain investigator Specter traced suspected thefts totaling more than $86 million across Ethereum, Tron, and Bitcoin. Two other researchers estimated the figure at between $72 million and $86 million. But Ledger stressed that it has yet to verify the number of people affected or the total losses.
The fallout has spread across the industry. European electronics retail giant MediaMarkt announced that it would remove all Ledger products from its physical stores and online platforms. Competitor Trezor also announced on October 13 that it would reduce its network of authorized distributors, effective January 1, 2027, and immediately stop supplying those channels. It emphasized that there is no evidence its own devices have been compromised; the move is a response to recent supply-chain incidents 💥
My take: this incident didn’t pierce the encryption—it exposed the final link in the hardware wallet business model: distribution. The industry has long said hardware wallets are the safest option because the keys stay offline and you get the device directly from an authorized source. But this incident shows exactly the opposite: if someone can tamper with a distributor, the device in your hands could look brand-new, have intact packaging, and run clean firmware—and still be a device with a spy inside.
The bigger problem is that you can’t prove the device is clean using conventional methods. You can verify a firmware change with a signature, and check a chip’s serial number. But an independent add-on that only reads the screen and sends a message leaves the device working as usual. That’s why Ledger’s only response has been to halt sales across the entire region: even Ledger doesn’t yet know at which point in the distribution chain the chip was planted.
For everyday crypto holders, there are three things worth watching next: First, will the investigation extend to markets outside Southeast Asia? Second, will tighter controls on distribution force more people to buy hardware wallets directly from manufacturers? Third, will multisig go from an institutional setup to a standard for individuals? Using devices from different manufacturers to create a multisig wallet means that even if one device is compromised, the funds can’t be moved.
Let’s discuss in the comments: Did you buy your hardware wallet from an official source or a third party? What do you check after unboxing it?
Every day, I bring you the latest from the crypto world—not just what’s happening, but the logic and opportunities behind the headlines 👀🚀