Ledger has confirmed that criminals placed hidden spying components inside cryptocurrency hardware wallets distributed through a Southeast Asian reseller. The company identified an altered device after customer theft reports emerged on October 9.
Independent blockchain researchers estimate losses above USD 90 million, although Ledger has not verified the total. Hardware wallets normally keep security keys away from internet-connected devices, but the implants could transmit sensitive information to criminals.
Malaysia-based CryptoBilis has suspended hardware wallet sales after customers reported cryptocurrency disappearing from their accounts. The retailer served buyers across Southeast Asia, including Malaysia, Indonesia and the Philippines.
A notice dated October 10 at its Kuala Lumpur shop said physical stores would remain closed until further notice. Investigators are examining how altered devices entered the retailer’s stock.
Ledger linked its confirmed theft cases to devices sold through CryptoBilis. The Paris-based manufacturer said criminals purchased genuine wallets, added concealed components and returned them to distribution. Its findings follow an earlier investigation into modified CryptoBilis wallets.
Blockchain analysis firm Galaxy estimated that around USD 91 million moved from 474 victim addresses, including Bitcoin and tokens across several networks. Ledger has not established how many customers received altered devices.
Ledger’s security researchers found that the unauthorized components could read the 24-word recovery phrase displayed during wallet setup. The information then travelled over a cellular connection using a built-in SIM. Anyone who obtains that phrase can restore the wallet elsewhere and control its cryptocurrency, even without possessing the original device.
CertiK executive Esme Pau said, “Real-world security depends on the entire process.” The added equipment worked separately from the wallet’s main security chip. That allowed the device to pass normal checks while secretly exposing recovery details.
An examination of how the hidden chips captured recovery phrases described the screen-monitoring method. Ledger maintains that attackers did not breach its internal systems, operating software or servers.
Questions about other sellers emerged after customers reported possible tampering beyond Southeast Asia. Ben Yorke, who bought a Ledger Flex at Singapore’s Changi Airport, noticed marks suggesting someone had attempted to open it. He sent the device to researcher Mark Karpelès, who identified a connector attached to its display and cellular hardware.
Karpelès told Bloomberg, “This is the kind of scale you see in spy movies.” Separately, a report involving a device in Germany prompted a suspension of Ledger retail sales in Germany. Ledger has been assessing reports from other sellers but has not confirmed that the same theft pattern extends across its wider distribution network.
Ledger has asked distributors in Southeast Asia and Hong Kong to halt sales while it checks devices and works with law enforcement. The company said its security team inspected products from stores and warehouses without finding unauthorized components in those samples. However, its investigation continues, and it has not identified every device potentially exposed to tampering.
Customers who bought a Ledger wallet through CryptoBilis within the previous 90 days have been told not to set up unused devices. Those who already used one should transfer their funds to a new wallet with a newly created recovery phrase, according to Ledger’s guidance.
Under new rules, authorized sellers must keep wallets off display shelves and must not resell returned products, even when their packaging appears unopened. Authorized retailers must promptly report customer concerns about unusual products to Ledger. Investigators have not identified those responsible.
Also Read: Google’s Willow Quantum Breakthrough Raises Concerns Over Satoshi’s Bitcoin