Ledger Wallets Impacted by Tampered Devices Sold in Southeast Asia

Tampered Devices Sold in Southeast Asia

Hidden cellular implants inside counterfeit Ledger wallets have been quietly transmitting recovery phrases to thieves, and the window to protect your funds may be narrower than you think.

Attack Details

The implant reads the recovery phrase directly from the screen and transmits it via built-in eSIM, bypassing Ledger's tamper-resistant secure hardware entirely.

Anyone who set up a device purchased from CryptoBilis should immediately move funds to a new Ledger with a freshly generated recovery phrase.

Response from Ledger

Ledger has confirmed the issue and urged resellers to stop selling affected devices.

Competitor Reaction

Competitors in the wallet market have also reacted swiftly, with Trezor finding no tampered devices from CryptoBilis but deciding to sever ties with the reseller regardless.

Market Reaction

Market reactions have been minimal, with Bitcoin dropping 0.4% and Ethereum declining 1.8% over the week ending October 16.

Recommendations

Ledger recommends that users only purchase from its official store or authorized resellers.

Conclusion

The attack targets one company's supply chain, rather than the underlying code or networks of Bitcoin or Ethereum, so coins stored elsewhere remain safe.

Precedent & Market Context

\1\1\1