Key takeaways
- Ledger temporarily halted hardware wallet sales across Southeast Asia and Hong Kong while investigating physically tampered devices
- The probe intensified after an unauthorized hardware implant was found that could potentially capture a user’s 24-word recovery phrase and transmit it to attackers
- Independent investigators estimate more than $86 million in crypto may have been stolen
Ledger asked resellers and distributors in Southeast Asia and Hong Kong to temporarily stop selling its hardware wallets while the company investigates a sophisticated supply-chain attack involving physically tampered devices.
The suspension covers Indonesia, Malaysia, Singapore, Thailand, Vietnam, the Philippines and Hong Kong. Ledger has also asked sellers to remove affected products from store shelves while its investigation continues.
The move is Ledger’s response to an incident that was initially linked to Southeast Asian reseller CryptoBilis.
What Led Ledger to Halt Hardware Wallet Sales?
The investigation began after users in Southeast Asia reported that cryptocurrency was unexpectedly being drained from wallets associated with devices that were purchased through CryptoBilis.
Ledger said on Oct. 9 that it was investigating the reports and asked CryptoBilis to stop selling and shipping Ledger products. Independent blockchain investigators have estimated that more than as much as $93 million was stolen, although Ledger has not confirmed an official total.
The situation became even more serious after Ledger confirmed that at least one affected device contained an unauthorized hardware implant.
Ledger later revealed how the implant worked. A small piece of additional hardware hidden inside the wallet was capable of reading the 24-word recovery phrase displayed on the device during setup. That information could then be transmitted to attackers over an LTE mobile connection using an eSIM.
Possession of a recovery phrase effectively allows an attacker to recreate a cryptocurrency wallet elsewhere and move its assets.
Ledger explained that the attack appears to be physical supply-chain tampering rather than a compromise of its internal systems, software or Secure Element. The company is still trying to determine where in the distribution chain the devices were altered.
Ledger Expands Its Response Across Southeast Asia
As the investigation widened, Ledger asked authorized resellers throughout the region to halt sales as a precaution.
The company said confirmed fund-loss incidents are still tied to Southeast Asia and it has not verified a wallet drain linked to a device purchased elsewhere. However, separate reports of potentially modified devices have also popped up in Europe, which caused MediaMarktSaturn to pause Ledger sales.
Ledger advised customers who bought devices from CryptoBilis not to initialize unused wallets. Those who already set up a potentially affected device should consider moving their cryptocurrency to a new wallet using an entirely new recovery phrase.
Overall, the incident could have massive consequences for the hardware wallet industry, as manufacturers now face new pressure to strengthen reseller controls, anti-tampering protections and supply-chain security.
