An LTE chip read 24 seed words, leading to a suspected $86 million crypto theft. Ledger confirmed that devices distributed by CryptoBilis had been implanted with the chip, which directly read the seed phrase displayed on the screen during setup. The Secure Element and firmware were never touched. In Germany, MediaMarkt Saturn has already stopped selling the devices after customers discovered that their signers had been tampered with.

Ledger has asked distributors in Southeast Asia and Hong Kong to pull the devices from sale while investigators determine where in the supply chain the tampering took place. Trezor Chief Commercial Officer Danny Sanders is taking a different approach: starting January 1, 2027, the company will cut ties with a number of authorized resellers—a move he calls a preventive measure. One stopped sales first and is investigating; the other is cutting off distribution channels first and talking later.

The security model for self-custody has always placed trust in the physical device, but a device passes through several hands on its way from the factory to the user. The Secure Element can protect against remote attacks, but not against someone slipping a chip into the box. So who should bear the blame: the distributors, or the brands that expanded their distribution networks so widely? $BTC