Ledger finds tampered reseller devices contained seed-phrase-stealing implant
Ledger confirmed that hardware sold by reseller CryptoBilis included an implant that captures recovery phrases. MediaMarkt has suspended Ledger sales in Europe after the disclosure.
Ledger has acknowledged that hardware sold through the reseller CryptoBilis was altered to include a malicious component intended to record wallet recovery words. MediaMarkt has paused European sales of Ledger devices once the issue became public. The episode highlights how the security of self-custody hardware can depend not only on the manufacturer but also on the distribution chain that delivers devices to users. Because recovery phrases can restore access to crypto assets, any tampering with the hardware that handles them may undermine confidence in buying such products through third-party sellers.
People who rely on hardware wallets, especially those who buy through resellers, could face heightened concerns about whether their devices remain trustworthy. Retailers and manufacturers may review distribution practices, while buyers may take extra steps to verify products before use. The disclosure could also affect confidence in crypto self-custody more broadly, though the extent may depend on how quickly the industry addresses supply-chain risks.