Ledger Asks Resellers in Seven Asian Markets to Pull Devices After Suspected $86M Drain
Ledger has requested resellers in seven Asian markets to halt sales of its hardware wallets due to an investigation into devices found with hidden implants that can steal recovery phrases, following suspected thefts totaling $86 million.
Intelligence analysis by Gemini 2.5 Flash
Ledger is investigating tampered hardware wallets in Southeast Asia and Hong Kong, where devices were found with implants capable of extracting recovery phrases. This has led to a suspension of sales in these regions and a reported $86 million in suspected thefts, though Ledger has only confirmed incidents in Southeast Asia.
Imagine your piggy bank has a secret trapdoor that someone put in before you even bought it, letting them sneak out your money. A company called Ledger makes special digital piggy banks for online money, but some were secretly changed before people bought them, letting thieves steal lots of digital cash. Now, Ledger is telling shops in some countries to stop selling these piggy banks while they figure out who put in the trapdoors.
Analysis
Ledger's Response
Ledger, a prominent hardware wallet manufacturer, has initiated a significant recall and sales suspension across seven key Asian markets, including Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. This decisive action involves instructing local resellers and distributors to halt sales and remove all Ledger devices from shelves. The company's immediate focus is on investigating reports of hardware wallets being tampered with, specifically devices found to contain a hidden implant designed to compromise user security. This regional focus underscores the localized nature of the confirmed incidents, which Ledger states have primarily occurred in Southeast Asia.
The company has clarified that all verified losses to date are linked to devices sold through CryptoBilis, a specific reseller operating within the affected region. Ledger is actively working to pinpoint the exact stage in the distribution chain where the tampering occurred, emphasizing that its own internal infrastructure, systems, services, and direct sales channels show no signs of compromise. This distinction is crucial for maintaining trust in Ledger's core operations, suggesting the vulnerability lies within the third-party supply chain rather than the company's direct manufacturing or software. The investigation aims to identify the perpetrators and prevent further incidents, which is vital for the brand's reputation and user safety.
The $86 Million Drain
The core of the security breach involves a sophisticated implant designed to extract the 24-word recovery phrase, often referred to as a seed phrase, directly from the device's screen during the initial setup process. This critical phrase, which grants full access to a cryptocurrency wallet and its funds, is then covertly transmitted via LTE. Once a malicious actor possesses this recovery phrase, they can easily restore the wallet on another device and transfer all associated digital assets, effectively draining the user's funds without their explicit consent. This method bypasses the typical security measures of hardware wallets, which are designed to keep the seed phrase offline and secure.
Onchain investigator Specter has played a pivotal role in tracking the financial impact of these suspected thefts, identifying a staggering sum exceeding $86 million. While Ledger acknowledges the incidents, it has not yet independently verified Specter's precise figure, indicating an ongoing process of reconciliation and confirmation. The scale of the reported losses highlights the severe financial risks posed by such supply chain compromises, underscoring the importance of vigilance for users purchasing hardware wallets, especially through third-party channels. The ability of an implant to exfiltrate the seed phrase during setup represents a profound breach of the fundamental security promise of hardware wallets.
MediaMarkt Saturn and Trezor
The repercussions of Ledger's security issues are extending beyond Southeast Asia, as evidenced by MediaMarkt Saturn's decision to cease sales of Ledger devices in Germany. This move, made with Ledger's agreement, followed a report from a German customer who discovered an implant in their purchased device. Although no funds were reported lost in this specific German incident, the discovery prompted a swift and cautious response from the major electronics retailer, indicating a broader concern about the integrity of the supply chain for these critical security devices. This incident suggests that while confirmed financial losses are localized, the potential for tampered devices might be more widespread.
The incident has also prompted a reaction from Ledger's direct competitor, Trezor, another leading manufacturer of hardware wallets. Trezor announced a precautionary measure to terminate its authorizations for resellers starting January 1, 2027. This proactive step is being taken despite Trezor stating that there is no evidence of its own devices being compromised. Trezor's decision reflects a heightened awareness within the industry regarding supply chain vulnerabilities and the critical need to ensure the authenticity and security of hardware wallets sold through third-party channels. This collective industry response underscores the gravity of the situation and the potential for widespread impact on user trust in self-custody solutions.
Key points
- Ledger has asked resellers in seven Asian markets to suspend sales of its hardware wallets.
- The action follows an investigation into devices found with hidden implants capable of stealing 24-word recovery phrases.
- Confirmed incidents are in Southeast Asia, linked to reseller CryptoBilis, with over $86 million in suspected thefts traced by an onchain investigator.
- MediaMarkt Saturn in Germany also stopped selling Ledger devices after a customer reported an implant, though no funds were lost.
- Rival Trezor is ending reseller authorizations as a precautionary measure, despite no evidence of its own devices being compromised.
Ledger's proactive investigation and collaboration with resellers, alongside rival Trezor's precautionary measures, could lead to enhanced supply chain security standards across the hardware wallet industry, ultimately improving user trust and protection against future tampering.
The confirmed incidents and suspected $86 million drain could severely erode user confidence in hardware wallets, potentially driving users away from self-custody solutions and towards less secure alternatives or centralized exchanges, increasing overall systemic risk in the crypto ecosystem.
Market signals
- BTC Security vulnerabilities in hardware wallets, a key component of crypto security, could negatively impact investor confidence in major cryptocurrencies like Bitcoin.
- ETH Similar to Bitcoin, the reported security breach in hardware wallets could diminish trust in the security of holding other major cryptocurrencies like Ethereum.
AI-generated analysis of potential market relevance. Not financial advice.
