Ledger issues security update on tampered wallets

TLDR

Ledger has issued a security update after confirming that some hardware wallets were physically tampered via a reseller, enabling large scale theft of user funds.

1. Ledger says all confirmed draining cases involve devices sold through Southeast Asian reseller CryptoBilis, including at least one wallet with an unauthorized hardware implant.
2. The companys update tightens supply chain controls and instructs CryptoBilis customers not to initialize unused devices and to migrate funds from used ones to a new seed on a verified device.
3. For all hardware wallet users, this is a serious supply chain warning: only buy from trusted channels, never reuse a possibly exposed recovery phrase and treat any unsolicited Ledger communication as suspicious.

Deep Dive

1. Scope Of The Tampered Wallet Incident

Ledger has confirmed that a subset of devices sold via CryptoBilis, an authorized reseller in Southeast Asia, were physically modified before reaching buyers, with an unauthorized hardware implant found in at least one affected wallet. Blockchain investigators estimate potential losses in the range of $86 million to about $94 million across hundreds of wallets, though Ledger has not formally confirmed the exact figure, calling the number of impacted devices limited in its 72 hour update.

Reports describe small circuit boards with cellular capability hidden behind the screen, designed to capture a users 24 word recovery phrase and transmit it, allowing attackers to rebuild the wallet elsewhere and drain funds without further access. Separate community claims of tampered devices at European retailer MediaMarkt exist, but Ledger has so far said all confirmed theft cases still trace to CryptoBilis, so the geographic spread beyond that channel remains unclear.

2. Ledgers Security Response And Update

In its security communications, including the 72 hour update, Ledger stresses that its core systems and direct sales channels were not breached and that all confirmed draining incidents involve CryptoBilis sourced devices. CryptoBilis has stopped selling all hardware wallets while investigations continue, and Ledger is working with authorities and affected users.

Ledger says it is strengthening supply chain security by tightening authorized reseller controls, reminding distributors not to resell returned devices and enhancing hardware protections against physical tampering, as echoed in its follow up statement on limited scope. The firm also reiterates that genuine check features verify the secure element but cannot guarantee a device has never been physically modified, so users must remain alert to signs of tampering.

3. Practical Takeaways For Wallet Users

If you bought a Ledger device through CryptoBilis, Ledgers guidance is clear: do not initialize any unused device from this reseller, and if you already used one, move assets to a new wallet generated on a verified device with a fresh recovery phrase. For other buyers, this episode highlights that even official resellers can become a weak link, so it is safer to purchase directly from the manufacturer or a well documented authorized partner and to avoid unboxed or returned units.

More broadly, never enter your 24 words on any website, never share them with support staff and treat physical letters or emails invoking Ledger security incidents as potential phishing. Keeping offline backups of your recovery phrase, checking transaction details on the hardware display and regularly reviewing official security notices are now more critical than ever.

Conclusion

Ledgers update confirms a serious but channel specific tampering attack, with tens of millions of dollars drained from compromised devices tied to one reseller. The company is tightening its supply chain and advising targeted users to rotate to new seeds, but the broader lesson is that self custody still depends on careful sourcing and strict protection of recovery phrases. For crypto users, treating hardware wallets as part of a wider security practice instead of a single point of trust is the most resilient response.