On October 9, a supply chain-related cryptocurrency theft occurred on Ledger wallets, resulting in losses exceeding $90 million.
In addition to CryptoBilis, retailers MetaPod, Challenger, and MediaMarkt have also been confirmed to have sold compromised Ledger devices.
As losses from cold wallet thefts have surpassed $200 million this year, the associated threat landscape has expanded to include vulnerabilities, brute-force attacks, and data breaches.
As previously reported by CoinPedia, the incident initially involved an encrypted wallet purchased from the Southeast Asian distributor CryptoBilis.
New information has emerged, expanding the list of affected distributors to four.
List of Compromised Ledger Distributors
The first is MetaPod, a distributor primarily located within major Asian airports, including those in Hong Kong and Malaysia. It has been confirmed that a Ledger Flex purchased from this distributor was implanted with malicious code.
The second is Challenger, a Singapore-based retailer whose store at VivoCity was identified as the source of the tampered Ledger Flex devices. CryptoQuant analyst Darkfost previously flagged this distributor as high-risk due to its proximity to CryptoBilis.
The third is the European retailer MediaMarkt Saturn, where a device confirmed to have been purchased has been infected. Another device from a similar retailer, MediaMarkt Trier, is currently under investigation. Both stores sourced their Ledger products from the European electronics distributor Aqipa GmbH, which has been supplying Ledger devices to Germany and Austria since August 2023.
It is worth noting that all of the above stores are officially listed as authorized distributors on Ledger’s official website. In addition to CryptoBilis, MediaMarkt/Saturn has also been suspended from providing Ledger sales and shipping services.
Ledger critics
Darkfost accused Ledger of being slow in its security response, noting that other on-chain analysts had already identified the threat before the company did. He added that some random X accounts have done a better job than this French company when it comes to Ledger wallet security checks. More importantly, Ledger has not offered to cover the shipping costs for recalling the devices.
Hardware wallet attack losses exceeded $200 million in 2026.
This Ledger attack involved components implanted after production, allegedly linked to CryptoBilis's covert ownership change in early August.
A larger attack occurred in July, when hackers exploited a software vulnerability to steal $116 million from Coldcard wallets.
Meanwhile, the Tangem wallet did not suffer any losses during a recent laser fault injection experiment, but the incident still undermined its claim of being “unhackable.” Ironically, the vulnerability was discovered by Ledger’s security research team, Donjon.
Additionally, in August, SafePal and Trezor's third-party logistics network leaked the personal identification information of thousands of customers.