A Spy Chip Inside the Wallet: The Ledger Supply-Chain Implant and the Retail Channels Nobody Audits

A hidden microcontroller, an extra circuit board, and a stolen 24-word phrase

Ledger has told every distributor and reseller in Southeast Asia and Hong Kong to stop selling its hardware wallets and pull the devices off shelves. This is not a firmware bug or a phishing campaign. Someone opened Ledger devices before they reached customers, added an extra circuit board inside, and put them back on the shelf. Owners are losing crypto without ever touching a suspicious link.

What was actually found inside

Ledger’s investigation started on October 9, after users reported losses. The company’s Donjon security arm has now published the details, which line up with earlier independent reports from Mark Karpelès and Tibane Labs. The implant is a separate microcontroller wired into the device. It watches the owner enter or restore the 24-word recovery phrase, decodes it, and transmits it out over an LTE connection using a provisioned eSIM.

This next part deserves attention from every hardware security team. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures. So when the device runs its integrity self-checks, everything passes. The attack hides from the self-checks because it lives in hardware the firmware does not inspect.

Where the tampered devices came from

All confirmed fund losses trace back to devices sold by CryptoBilis, a reseller operating in Southeast Asia. But the perimeter is not that tidy. Users have reported compromised devices bought from a Metapod tech retailer at the Singapore airport, and from MediaMarkt stores in Europe. MediaMarkt sources Ledger devices through a distributor called Aqipa GmbH and has pulled the product from its shelves while the investigation continues.

Ledger’s halt now covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong, and stays in force until investigations into device safety are complete. The company says its own infrastructure, systems, services, and direct sales channel are safe to use.

Trezor’s answer: fewer partners, tighter checks

Trezor, another major hardware wallet vendor, announced plans to reduce its reseller network to strengthen oversight. It found no evidence its devices were compromised, but is ending partnerships with affected resellers on January 1, 2027 and revoking their authorization to sell Trezor devices. Its statement promised an updated legal framework and closer checks on how devices are sourced, stored, and handled. Both major vendors now treat distribution itself as a security problem, not a logistics detail.

What this means for enterprises here at home

Crypto custody increasingly passes through resellers, courier routes, and retail shelves that no security team ever audits. The Ledger implant is a lesson in trust boundaries: a secure element protects keys from software attacks, and it does not protect you from a physical device you never opened.

• Buy direct where possible. If a vendor offers its own sales channel, the third-party retail discount is not worth the risk.
• Never reuse a recovery phrase from a suspect device. If a wallet came through an opaque channel and funds move unexpectedly, treat the phrase as stolen and rotate to a new one on a device from a verified source.
• Inspect before you trust. Tamper evidence, weight differences, and unexpected screws are cheap checks that integrity self-checks never perform for you.
• Put hardware custody in your asset inventory. Enterprise inventories track laptops and tokens. They rarely track where a signing device was bought, from which seller and which distributor.

eHawu: verification that goes past the firmware

eHawu builds trust verification into the layers most stacks ignore: provenance, physical custody chains, and network behavior. Implants like this one succeed because they transmit over an LTE connection that nobody in the victim’s network can see; a radio inside a device that should never touch a network is a loud anomaly once someone watches the network layer. That is where eHawu operates for African fintech and enterprise customers, alongside zero-trust segmentation that assumes any purchased device may have had a second life before it reached your hands.