Ledger halts Asian wallet sales amid tampered-device investigation
Ledger asked resellers and distributors in Southeast Asia and Hong Kong to stop selling its wallets and remove them from shelves during a tampering investigation. Devices sold by CryptoBilis contained an implant that captured the 24-word recovery phrase and sent it over LTE using an eSIM, without changing the Secure Element or Ledger OS. Confirmed losses were linked to CryptoBilis, but users also reported modified wallets from other sellers, and Trezor said it would shrink its reseller network.
Ledger's Donjon security team confirmed a separate microcontroller inside affected CryptoBilis wallets. It captures the 24-word backup phrase during setup or recovery, then transmits it over LTE via an eSIM. Since the Secure Element and Ledger operating system stay unchanged, routine self-checks do not detect it. Earlier findings from Mark Karpelès and Tibane Labs were largely corroborated.
Confirmed losses trace to CryptoBilis, yet buyers also reported altered devices from a Singapore airport retailer, Metapod, and from MediaMarkt in Europe, which pulled stock supplied via Aqipa. Ledger broadened its sales pause across Southeast Asia and Hong Kong. Trezor, finding no compromise, still plans to cut resellers from January 1, 2027.
Hardware-wallet buyers, especially in affected Asian markets, may face delays, refunds, or uncertainty about whether a device can be trusted. Retailers and distributors could see reputational damage and tighter partner requirements, while manufacturers may invest more in tamper-evident packaging and reseller oversight. If such implants become more common, confidence in self-custody could weaken, potentially pushing some users toward exchanges or other custodial services despite their own risks.