Hardware wallet maker Ledger disclosed on October 13 how an unauthorized component inserted into devices sold by CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines, operated in connection with incidents in which customers lost funds. Ledger said on October 9 that it was investigating and found the component the following day in a device belonging to one affected user.
The component reads the 24-word recovery phrase displayed during initial setup and transmits it over an LTE mobile network using a preconfigured eSIM. Ledger said it does not alter the secure element, operating system, transaction details or signatures. An attacker who obtains the recovery phrase can restore the wallet on another device and move funds without the original device.
Ledger described the incident as a physical supply-chain attack and said it had found no indication that its internal systems were compromised. All fund losses identified so far were linked to devices sold by CryptoBilis, while reports of unauthorized components from other sellers are also under investigation. Separately, MediaMarktSaturn halted in-store and online sales on October 13 after a German customer reported a component. No loss of funds was reported in the German case.
Ledger advised customers not to use uninitialized devices purchased from CryptoBilis. Those who have already used one should generate a new recovery phrase on a new device and move their assets. The company is also investigating at what point in the distribution chain the devices were altered.