Ledger Hardware Wallets Compromised at Resellers With Hidden Chips for Stealing Crypto Keys

While purchasing hardware wallets directly from Ledger remains secure, the company's reseller channels in certain regions have become a vector for theft. Cryptocurrency holders typically turn to dedicated hardware wallets such as Ledger devices to protect their assets, yet an ongoing investigation demonstrates that this strategy carries risks when purchases are made through unauthorized distributors. Compromised units sold by resellers in Southeast Asia and Europe have been fitted with eSIM and LTE modules capable of extracting recovery phrases, resulting in reported losses exceeding $93 million to date.

The first discovered tampered device came from Cryptobilis, a reseller that has now halted all hardware wallet sales across its product lines. The compromised unit originated from a Malaysian location, though Cryptobilis also operates in Indonesia and the Philippines. Security researcher Mark Karpelès has been investigating these modified wallets, and identified another instance purchased through Amazon Japan from a Chinese seller with shipment originating in Malaysia. Cryptobilis carries multiple wallet brands including Trezor, Coolwallet, and Tangem, though contamination has only been confirmed in Ledger products so far.