Ledger Suspends Hardware Wallet Sales Across Asia After Supply Chain Attack
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to stop selling its cryptocurrency hardware wallets and remove them from store shelves while the company investigates a supply chain attack.
The decision follows the discovery that Ledger devices purchased from Southeast Asian reseller CryptoBilis had been modified with hardware implants designed to steal the seed phrases used to access cryptocurrency assets. The stolen phrases were reportedly transmitted to unauthorized parties over LTE connections.
Ledger hardware wallets store the private keys used to manage and authorize digital asset transactions.
After multiple users reported cryptocurrency losses, Ledger launched an investigation on October 9 and confirmed that some devices sold by CryptoBilis had been tampered with.
Ledger’s Donjon security department shared additional details about the attack. The hardware implants found in devices sold by resellers largely confirm earlier reports from Mark Karpelès and Tibane Labs.
According to Donjon, the implant’s microcontroller detects and decodes a 24-word recovery phrase when a wallet is set up or restored. It then sends the phrase over LTE using the device’s provisioned eSIM.
The implants cannot be detected by Ledger’s integrity self-check because they are separate components. They do not modify the Secure Element or the Ledger operating system, nor do they alter cryptocurrency transactions or digital signatures.
Ledger discovers additional compromised devices
Ledger said all confirmed financial losses involved devices sold by Southeast Asian reseller CryptoBilis. However, users have also reported compromised devices purchased from other sellers in Asia and Europe.
Users reported modified wallets obtained through MetaPod, Singapore Airport and MediaMarkt, according to posts shared on social media.
MediaMarkt obtained the Ledger device from distributor Aqipa GmbH and is now removing the product from its shelves following the reports.
Ledger has ordered a broad suspension of sales by its distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong until its investigation into the safety of the devices is complete.
The company said its infrastructure, systems, services and direct sales channels remain safe to use.
Trezor reduces its reseller network after Ledger supply chain attack
Trezor, another major cryptocurrency hardware wallet vendor, has announced plans to reduce its reseller network to improve oversight and help prevent supply chain attacks.
“Security in the supply chain never ends, which is why we are raising the bar for all of our partners who continue with Trezor by updating our legal framework and putting more stringent checks on how devices are sourced, stored and handled,” Trezor said.
Trezor said it had found no evidence that its devices had been compromised, but decided to act quickly as a precaution.
In a letter to affected resellers, Trezor said the partnership will end on January 1, 2027, when the license to sell Trezor devices will be revoked.
Join Mikko Hypponen and security leaders from the NFL, Chanel and Atlassian for a two-hour digital summit about AI-speed attacks, what defenders should stop doing, and how to verify, decide, correct and revalidate at machine speed.
Source: www.bleepingcomputer.com