Ledger Pulls Devices From Asian Markets Over Spy Implant as Trezor Cuts Resellers

Ledger has asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales of its devices and remove them from shelves while it investigates a supply-chain attack, the company said in an incident update this week. The move widens an earlier halt that applied only to CryptoBilis, the Southeast Asian reseller whose devices Ledger has tied to every confirmed loss so far.

Onchain investigator Specter has traced more than $86 million in suspected thefts linked to the incident, which Ledger dates to Oct. 9. Ledger said it has not verified that figure.

Ledger's Donjon security team found that some signers sold by CryptoBilis contained a covert implant inside the device enclosure, according to the company's investigation update on Tuesday. When a user set up the wallet, a microcontroller in the implant read the 24-word recovery phrase as it appeared on the screen and transmitted it over the LTE mobile network using an eSIM. Anyone holding that phrase can restore the wallet elsewhere and move the funds. Ledger said the implant did not alter the Secure Element, the operating system or any transactions, and that it has no indication that its own infrastructure, services or direct sales channel were compromised. It is still trying to establish who tampered with the devices and at what point in the distribution chain.

The case widened on Tuesday when Mt. Gox's former CEO Mark Karpelès posted a teardown of a Ledger Flex he said contained a spy implant. The unused device belonged to Ben Yorke of WOO, who noticed suspicious marks on it and sent it to Karpelès for inspection. Yorke said it was bought from a retailer called Metapod at Singapore's airport, which would make it the first reported tampered unit sold by a reseller other than CryptoBilis. Ledger has not confirmed a link between the Singapore device and the earlier cases. In Europe, electronics chain MediaMarkt Saturn also stopped selling Ledger devices with Ledger's agreement after a customer in Germany reported an implant, though no loss of funds was reported.

Rival Trezor responded the same day by announcing that it will cut its reseller network, citing "recent supply-chain incidents." Chief commercial officer Danny Sanders said the cut reflects how many partners Trezor can vet closely itself. Affected resellers will lose their authorization on Jan. 1, 2027, will receive no new stock, and will be removed from Trezor's list of authorized sellers, though they can sell existing inventory through the holiday season. Those that remain will face stricter rules on how devices are sourced, stored and handled. Trezor said there is no evidence its own devices were compromised, and Sanders described the move in a letter to partners as "a precautionary measure to protect our supply chain and our customers."

The incident is not the first time Ledger buyers have been targeted with physically modified hardware. After a 2020 breach exposed the names and addresses of hundreds of thousands of Ledger customers, scammers mailed some of them counterfeit devices fitted with extra components. This case is more serious because the tampered units appear to have moved through ordinary retail channels, where buyers had no reason to suspect them.

Ledger CTO Charles Guillemet said the company is reviewing its reseller controls and anti-tamper protections. Until it identifies where the devices were altered, the safest course for buyers is to purchase directly from manufacturers and to treat any device with signs of tampering or a pre-set recovery phrase as compromised.