Ledger Wallet Scare Reaches 4 Retailers Across 3 Countries: How Many Devices Are Affected?
Share
Key Takeaways
Ledger’s supply-chain attack has expanded beyond CryptoBilis, with compromised hardware wallets reported at four retailers across three countries.
Blockchain investigators estimate losses approaching $93 million across more than 300 wallets, although Ledger has not verified the figures.
Rival Trezor is cutting authorized resellers from January 2027 despite finding no evidence that its own devices were compromised.
Ledger’s hardware wallet security crisis is spreading beyond its original Southeast Asian origins, with reports of tampered devices emerging from retailers in Germany and Singapore.
What began as an investigation into compromised devices sold by authorized reseller CryptoBilis has now raised concerns about the security of Ledger’s wider distribution network.
Four retailers have been linked to confirmed or reported tampering incidents, while investigators estimate cryptocurrency losses approaching $93 million.
However, Ledger has not confirmed how many devices were compromised or whether thefts occurred outside CryptoBilis.
The fallout has also reached rival hardware wallet manufacturer Trezor, which is reducing its reseller network despite reporting no compromise of its products.
Try Our Recommended Crypto Exchanges
Sponsored
Disclosure
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
Ledger Attack Spreads to Germany and Singapore Retailers
Ledger confirmed that devices sold through CryptoBilis contained unauthorized electronic implants capable of stealing wallet recovery phrases.
The investigation has since expanded to additional retail locations.
In Germany, electronics chain MediaMarktSaturn suspended Ledger sales across its European stores and online platforms following a customer report involving an implanted device.
Incident Update – Oct 13th, 2026
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices while the investigation is ongoing. This includes taking products off the shelves.
Ledger acknowledged the incident but said no associated financial loss had been reported.
Meanwhile, former Mt. Gox CEO Mark Karpelès reported discovering a suspicious implant inside a Ledger Flex purchased from a MetaPod outlet at Singapore’s Changi Airport.
Another allegedly modified Ledger Flex was linked to Challenger’s VivoCity location in Singapore.
CryptoQuant analyst Darkfost has also expanded a watchlist of potentially exposed distributors and resellers.
🚨 LEDGER UPDATE :
With the latest developments, I've updated the list of Ledger resellers and the associated risks.
• A Ledger Flex bought from a MetaPod vending machine at Singapore airport has been confirmed infected.
However, inclusion on that list does not establish that a retailer sold compromised products.
The geographic spread raises a critical question: were devices modified at individual retailers, during distribution, or earlier in the supply chain?
Ledger has not publicly established where the tampering occurred.
How Did Hackers Steal Recovery Phrases Without Breaking Ledger Security?
Ledger’s Donjon security team identified an implant that exploited a fundamental weakness in hardware wallet security: users must see their recovery phrases during setup.
The malicious component monitored the device’s display, captured the 24-word recovery phrase, and transmitted it through an LTE connection using an embedded eSIM.
That phrase can restore control of a cryptocurrency wallet on another device.
Consequently, attackers did not need to break Ledger’s Secure Element, extract private keys directly, or manipulate transaction signatures.
The implant operated independently of Ledger’s operating system, allowing the device to function normally while secretly exposing its recovery credentials.
This distinction explains why standard device authenticity checks may fail to identify sophisticated physical tampering.
Onchain investigators have estimated losses of up to $93.2 million involving more than 300 wallets. Tether also reportedly froze approximately $10 million in USDT connected to the theft.
However, those estimates do not establish the number of physically compromised Ledger devices. One affected recovery phrase can control multiple cryptocurrency addresses.
Ledger maintains that its internal systems and services remain secure.
Trezor Drawn Into Hardware Wallet Scare as Tampering Claims Surface
The security concerns surrounding Ledger have also reached rival hardware wallet manufacturer Trezor, although the extent of any impact remains unclear.
On Oct. 13, X user DelCrxpto claimed that tampered Trezor devices had also been discovered, suggesting the incident was no longer limited to Ledger.
However, the post did not provide independently verified evidence of compromised Trezor devices, and the allegation should not be treated as confirmation that Trezor has suffered a supply-chain attack.
Meanwhile, on Oct. 13, Trezor announced plans to reduce its authorized reseller network following the security scare.
Chief Commercial Officer Danny Sanders informed selected partners that their authorization would end on Jan. 1, 2027.
Danny Sanders informed selected Trezor partners that their authorization would end on Jan. 1, 2027. | Source: @Dantoshi
The affected retailers will stop receiving new inventory, while remaining authorized partners face tighter requirements covering product sourcing, storage and handling.
Importantly, Trezor has found no evidence that its own hardware wallets were compromised.
The restructuring is preventive rather than a response to confirmed attacks against Trezor devices.
Nevertheless, the decision highlights a wider industry problem.
Hardware wallets are marketed as a safer alternative to storing cryptocurrency on centralized exchanges because users retain control of their private keys. But that security model assumes customers receive authentic, untampered devices.
If attackers compromise hardware before delivery, even sophisticated cryptographic protections may be insufficient.
Ledger has advised CryptoBilis customers not to initialize unused devices. Those who have already used potentially affected wallets should move funds to a trusted new device using a newly generated recovery phrase.
For the broader industry, the unanswered question is no longer simply how much cryptocurrency was stolen.
It is how many compromised devices remain in circulation and whether manufacturers can reliably detect them before customers put their savings at risk.
Disclaimer:
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
