The Ledger supply chain attack incident continues to escalate. All disclosed cases of stolen coins involve the distributor CryptoBilis, and this channel has stopped selling hardware wallets. Ledger claims that its own systems and direct sales channels are unaffected, but the community has discovered more potentially risky distributors (involving more than 20, distributed on platforms such as Lazada), and cases of abnormal devices have appeared in Asia, South America, Europe, and other regions.
Attack characteristics: Security researchers found unauthorized implanted hardware components inside the devices, and some versions can be hidden behind the screen; the high-end model Ledger Stax has also been reported to have an additional communication module (Nordic nRF9151) and suspected antenna wires. SlowMist founder Cos said the attackers can be called "hardware hacking" experts.
Ledger's response: Cooperating with law enforcement agencies in the investigation, advising users not to initialize unused devices; devices that have already been set up should have their assets transferred to new devices and a brand-new mnemonic phrase generated, while strengthening distribution controls and anti-tampering processes, requiring distributors to purchase only through authorized channels.
Industry response: OneKey terminated CryptoBilis's authorization and suspended new distributors; SafePal emphasized multiple verification mechanisms (device authenticity, activation status, tamper-evident seals); Trezor removed CryptoBilis and warned against disassembling devices on your own; Tangem focused on explaining the integrated design of the security chip (private keys cannot be exported, firmware cannot be modified); imKey stated it was unaffected but will verify channels.
Core warning: The impact of the incident far exceeds the coin theft itself, shaking the foundation of users' trust in the "security defense line" of hardware wallets. Consumers should buy only from official channels and verify device authenticity before use; manufacturers need to rebuild confidence with transparent investigations and verifiable supply chain control measures, otherwise the security consensus on which the industry depends for survival will face a long-term test.
Author: Nancy, PANews
The Ledger supply chain attack incident continues to escalate. As more cases of abnormal devices are exposed and potentially risky distributors surface, this security storm triggered by third-party distribution channels is constantly expanding. Although Ledger claims that its own systems and direct sales channels are unaffected, the incident has pushed the supply chain security issue of hardware wallets to the forefront.
What is more alarming than the coin theft incident itself is that user trust is wavering. Hardware wallets, once regarded as an important defense line for safeguarding crypto assets, are now facing a trust stress test. This crisis tests not only Ledger's brand reputation, but also the security trust foundation on which the entire hardware wallet industry depends for survival.
The Ledger supply chain attack mystery expands, security personnel admit the attackers are highly skilled
As more abnormal samples and potentially risky channels surface, the scope of impact of the Ledger supply chain security crisis is attracting increasing attention.
On October 11, crypto analyst Darkfost posted that after the CryptoBilis-related security incident was exposed, other potentially risky distributors, including some Lazada platform merchants, appeared in community discussions. At present, Ledger cannot yet confirm whether CryptoBilis is the only sales channel involved in the risk. Considering that some distributors are related in regional distribution, Darkfost believes that the possibility that multiple channel supply chains were compromised at the same time cannot be completely ruled out.
Based on information disclosed by the community, he compiled a list of "potentially risky Ledger distributors," involving more than 20 distributors. Although the relevant risks have not yet been confirmed, he still reminded users that if they have purchased a Ledger hardware wallet through the channels listed in the past 6 months, they should carefully evaluate the device's security and consider migrating assets to a new secure device.
At the same time, suspected related cases have appeared one after another in Asia, South America, Europe, and other regions, further intensifying market concerns about the scope of the attack. Security researcher Johannes disclosed that a user discovered unauthorized implanted hardware components inside a hardware wallet several weeks after purchasing it from an official Ledger distributor in Europe. Johannes said that the implant appears to use an earlier design, while newer versions of the implanted components may be hidden behind the screen, making detection even more difficult.
The range of device models suspected of hardware tampering is also expanding. In addition to the mainstream product Ledger Nano X, the high-end flagship model Ledger Stax has also been reported to have suspected hardware tampering. Twitter user @Wentrre, after disassembling their own Ledger Stax, found an extra small board on the motherboard, as well as a cellular communication module labeled Nordic nRF9151, and there were also suspected antenna wires inside the device. Because these structures raised security concerns, the user subsequently asked Ledger whether the device was abnormal.
In response, Cos, founder of the security firm SlowMist, released a disassembly comparison image, pointing out that the abnormal sample contained an additional communication module and suspected antenna wires, while the reference images of the official genuine Stax did not show these structures. Cos stated bluntly that in this Ledger backdoor implantation incident, the people involved can be called "hardware hacking" experts.
As more cases are exposed, market concerns about the security of hardware wallets continue to intensify. Some users said they no longer dare to power on the Ledger wallet they just bought and can only set it aside for now; others choose to disassemble the device themselves and publish internal photos, seeking help from the community and security researchers for verification, and many disassembly tutorials have also appeared on social platforms.
Who would have thought that hardware wallets, originally regarded as an important defense line for safeguarding private keys and isolating network risks, have now become a question users need to reconfirm even regarding whether the device itself is trustworthy.
All disclosed coin theft cases involve CryptoBilis, and multiple hardware wallet companies respond urgently
In the face of this black swan event involving nearly $100 million, in the early hours of October 12, Ledger released a 72-hour update statement on the CryptoBilis incident, disclosing the latest investigation progress and subsequent response measures.
Ledger stated that the company is cooperating with relevant law enforcement agencies in the investigation, has currently confirmed a limited number of affected devices, and has proactively contacted the relevant users. It advises affected users to contact Ledger customer service through official channels and report the case to local law enforcement agencies.
Ledger also emphasized that, as of the time of the announcement, all confirmed cases of stolen funds involved devices sold through CryptoBilis, and the company's own systems and direct sales channels were unaffected. CryptoBilis has now confirmed that it has stopped selling all hardware wallets.
For potentially affected users, Ledger specifically reminded them not to initialize the relevant devices that have not yet been used; if the device has already been set up, assets should be transferred to a new device obtained through official channels, and the new device should be used to generate a brand-new mnemonic phrase.
In terms of subsequent response, Ledger stated that it will continue to review and strengthen distribution controls and anti-tampering processes, while requiring distributors to purchase products only through authorized channels and never to relist returned goods for sale, and calling on users to avoid purchasing hardware wallets through unauthorized channels to reduce the risk of buying tampered or counterfeit devices.
It is worth noting that CryptoBilis does not only sell Ledger. As the incident continues to escalate, hardware wallet brands such as OneKey, SafePal, Trezor, and Tangem have also responded one after another.
OneKey founder Yishi stated that no reports of related device damage have been received so far, but the company has terminated CryptoBilis's authorized distributor qualification and provides free replacement services for users who purchased related products through this channel. At the same time, OneKey announced the suspension of new distributors and a comprehensive re-review of existing distribution channels. For distributors whose business entities or ultimate beneficiaries cannot be verified, the company will cancel their authorization and plans to publish a complete list of authorized distributors after the review is completed.
SafePal stated that it has noted reports of asset theft involving Ledger devices purchased through CryptoBilis and is closely following the progress of the incident. In response to users' concerns about supply chain security, SafePal introduced the multiple protection mechanisms currently in place for its hardware wallets, including verifying the authenticity and usage status of the device during initial setup, issuing warnings for devices that have been previously activated and displaying the first activation date, and identifying whether the packaging has been opened through tamper-evident seals. SafePal reminded users that if they find any abnormal inspection results, they should immediately stop using the device and contact the official team.
Trezor likewise stated that it is actively investigating the CryptoBilis reseller security incident, and there are currently no indications that its devices have been affected. As a precautionary measure, Trezor has removed CryptoBilis from its list of authorized resellers and stopped selling products through that channel. At the same time, Trezor reminded users not to disassemble devices themselves to avoid damage; for the Safe 7 with a built-in battery, users should also pay attention to the related additional security risks.
Tangem responded to external concerns from the perspective of product design. The company stated that its card-style hardware wallet adopts an integrated sealed design of the secure chip and NFC antenna, with the private key generated inside the chip and transaction signing completed within it, never leaving the chip; the device firmware cannot be modified after being written at the factory, and users can also verify the authenticity and first activation status of the device through the Tangem App. It emphasized that regardless of whether users purchase through the official store, a reseller, or other channels, as long as the App verifies that the device is genuine, it can ensure that the private key is controlled only by the user, including devices purchased through CryptoBilis.
imKey also issued a statement saying that, as of now, it has not received any feedback related to abnormalities in imKey devices or asset losses connected to this incident. Out of prudence, imKey will further review its authorized distribution channels and take necessary measures based on the review results to reduce channel risks.
Judging from these responses, each manufacturer is attempting to respond to market doubts about device security through channel rectification, explanations of product security mechanisms, and user risk reminders. These statements may be able to alleviate users' anxiety to some extent, but they may not be enough to quickly repair the trust that has already been damaged.
For hardware wallet manufacturers, truly emerging from the crisis still requires more convincing practical actions, including transparent and verifiable investigation results, clear risk screening and handling plans, and supply chain controls and anti-tampering measures that can withstand scrutiny.
