Ledger Hardware Wallets in Southeast Asia Found Tampered, $102M Stolen

Customers in Southeast Asia discovered in early October that crypto had disappeared from Ledger hardware wallets that still appeared to work normally. The customers bought the devices through CryptoBilis, an authorized reseller operating in Malaysia, Indonesia and the Philippines. Ledger confirmed an unauthorized implant in one affected customer's device on Oct. 10. Three days later, Ledger's security team explained that added electronics copied the wallet's 24 recovery words during setup and transmitted the words over a mobile connection. The protected chip, operating system and transaction signatures remained unchanged. Bitquery estimates attackers stole $102 million from 324 wallets across six networks, although Ledger has not confirmed that total or established that every loss involved an implanted device.

Hardware wallets protect private keys used to authorize transactions, while the crypto remains on blockchain networks. A wallet signs an approved transaction without giving the connected computer the private keys. During setup, a Ledger wallet displays 24 recovery words that can recreate the wallet and its keys if the device is lost. Owners are instructed to write down the recovery phrase, keep the phrase offline and never share the phrase. Anyone with the recovery phrase can restore the same accounts on another device without being stopped by the original wallet's PIN. Ledger said a small controller intercepted information sent to the display, reconstructed the recovery phrase and transmitted the phrase over LTE using an embedded SIM card.

The implant did not need to compromise the protected chip or trick the owner into entering recovery words on a fake website. An owner could complete setup and approve legitimate transactions while an attacker retained equivalent access to the funds. An optional additional passphrase can protect accounts created with that passphrase, but recovery words alone are sufficient for ordinary accounts. Ledger's Genuine Check verifies that a device contains an authentic Secure Element, the chip responsible for sensitive security operations. Genuine Check can identify a counterfeit chip but cannot inspect every component or prove that nothing was added after manufacture. Ledger's security documentation warns that physical modifications may escape detection when the original chip remains intact.

Tibane Labs examined modified Ledger Nano X devices containing electronics that monitored signals between the secure chip and the screen. A more sophisticated specimen concealed a custom board beneath the display and retained the original battery, preventing casual inspection from revealing the modification. Those specimens were separate from the CryptoBilis investigation and do not establish that the same devices or attackers were involved. Authentic chips, correct signatures and normal operation do not prove that an entire device is free from tampering.

Ledger recommends buying through authorized sellers, making the CryptoBilis case a question of trust throughout the distribution chain rather than simply counterfeit products. Ledger said in an Oct. 15 update that attackers bought genuine devices over several months, opened the devices, installed custom components and returned the devices to distribution through Southeast Asian resellers. Ledger described the incident as an attack on the distribution channel. Ledger said samples checked in warehouses and stores showed no tampering. Ledger said the company had asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales. Ledger is tightening controls on returned products and asking sellers to keep devices off display shelves. Germany's MediaMarktSaturn suspended Ledger sales following a report of a tampered device. Trezor moved to reduce the rival wallet maker's reseller network despite finding no evidence that Trezor products were compromised.

Bitquery found that 25 Tron wallets signed the same approval within three seconds, a pattern consistent with someone already controlling multiple accounts. Blockchain records cannot identify who opened packaging, installed components or returned a device to a shop; those questions require hardware examinations and distribution records.

Buying new hardware and entering the old 24 recovery words recreates the same risk because the old phrase restores the same keys. Assets need to move to accounts generated from a fresh recovery phrase on a trusted device, using carefully verified addresses and instructions. Ledger told CryptoBilis buyers not to initialize unused devices and advised customers who had already completed setup to move funds to a new signer with a new phrase. Affected owners should use official support channels, preserve potentially relevant evidence and never give recovery words to someone claiming to help recover money. The incident shows that hardware-wallet security extends through the screen, casing, packaging and distribution chain until recovery words first appear. Self-custody removes the need to trust an exchange to hold private keys, but owners must still trust the hardware that creates and displays those keys.