Ledger表示，已确认的篡改事件仍局限于……

Ledger has suspended the sale of hardware wallets in Southeast Asia and Hong Kong. The company is conducting an investigation into incidents of supply chain manipulation.

Ledger has requested its distributors and retailers in six Southeast Asian countries and Hong Kong to cease selling its hardware wallets and dispose of any existing inventory. This measure is part of the company’s efforts to investigate how physical devices can get into the retail supply chain. The suspension applies to products sold in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. This expands the scope of the investigation, which was initially focused on CryptoBilis, a Southeast Asian distributor involved in reports of user wallet funds being stolen.

Ledger stated that all confirmed losses are related to devices sold in Southeast Asia. The company has not yet determined whether any devices purchased in other regions were involved in wallet fund theft incidents. “The investigation is still ongoing to determine who manipulated these devices and at which stage of the distribution chain the manipulation occurred,” Ledger said.

Why did Ledger expand the scope of the sales suspension?

On October 9th, after Ledger demanded that CryptoBilis suspend sales and deliveries in order to review the reported fund losses, the investigation was made public. Initially, Ledger claimed that the incident seemed to involve only that distributor, and that its own infrastructure, systems, and services were not affected. However, after Ledger’s Donjon security team inspected one of the affected devices, things changed significantly. They discovered an unauthorized hardware implant.

These additional electronic components can monitor the 24-word recovery phrases that appear on the screen during the device initialization process. They can reconstruct these phrases and transmit them using the LTE cellular connection via the embedded SIM card. This implant operates without needing to compromise Ledger’s secure elements, operating system, or transaction signature processes. This difference transforms this attack from a traditional software vulnerability into a physical supply chain attack. Once the recovery phrases are obtained, attackers can re-establish their wallets elsewhere and transfer assets, without having to continue accessing the compromised device.

Investors should be aware that the risk has shifted. The core risk now lies in whether Ledger can ensure the integrity of devices across its broader distribution network.

Can Ledger’s “authenticity verification” detect implants?

Not necessarily. Ledger’s own security documentation indicates that its authenticity verification function can identify the secure elements within devices. However, it cannot detect unauthorized modifications, such as spy implants. This limitation is crucial, as confirmed attacks seem to be designed to avoid touching Ledger’s core encryption hardware. Therefore, a wallet may contain authentic secure elements, but other parts of the device may still have additional hardware that can capture sensitive information.

Ledger recommends that customers of CryptoBilis who have their devices initialized should use a new recovery phrase to transfer their assets, rather than simply transferring the existing seed phrase to another signing tool. The company has not yet confirmed the total amount of funds stolen or the number of affected customers. Independent blockchain researchers estimate the amount to be over $86 million, but Ledger states that these figures have not been verified yet.

Why are European retailers also removing Ledger products from their shelves?

As some customers reported that Ledger wallets purchased from European retailers appeared to have unauthorized modifications, this issue has attracted attention beyond Southeast Asia. On October 13th, a customer in Germany reported discovering unauthorized implants in a Ledger wallet. As a result, MediaMarktSaturn removed Ledger products from stores and online platforms across its international retail network. The retailer described this action as a preventive measure. Ledger has not confirmed any cases of fund theft related to German devices, nor has it determined whether the cases reported in Europe are part of the same supply chain as the CryptoBilis case. Additionally, Mark Karpelès, former CEO of Mt. Gox, released a report stating that a Ledger Flex wallet purchased at a Singaporean airport contained unauthorized implants. However, Ledger has not officially confirmed that this device was involved in this incident.

Investors should be aware that the scope of the problem may expand.

If cases outside the original distributor network are confirmed, the scope of Ledger’s supply chain issues could become much larger.

What needs to be determined next by Ledger?

The main issue that remains unresolved is where the devices were tampered with. Investigators need to determine whether the tampering occurred at distributors, dealers, logistics providers, or during the return process of defective products. It’s also important to distinguish between these scenarios. Current evidence suggests that the physical devices themselves were modified, rather than attackers gaining access to Ledger’s internal systems. However, the widespread suspension of sales in seven Asian markets has raised the bar for Ledger. The company must identify the points of vulnerability, determine how many devices may have passed through the affected distribution chain, and establish whether reports from other regions are isolated cases or indicative of larger-scale operations. Until the investigation is complete, this incident highlights that the security of hardware wallets depends not only on cryptography and secure components, but also on factors that users cannot easily verify themselves—such as the physical condition of the devices before they reach users’ hands.