The attack, which targeted users who had purchased Ledger devices from CryptoBilis, an authorized reseller covering Malaysia and Southeast Asia, involved physical tampering at some point in the supply chain. Attackers manually installed a chip equipped with a cellular or LTE module inside brand-new devices. When a user generated or verified their 24-word recovery seed phrase during initial setup, the rogue chip recorded the OLED output or read the raw hardware data lines, then silently transmitted the unencrypted recovery phrase over LTE to the attackers' command servers. This allowed attackers to clone private keys and drain associated cryptocurrency funds.
Ledger CEO Pascal Gauthier said in a social media post that physical supply chain tampering is a risk for the whole industry and that the company is reviewing controls applying to direct sales and resellers. Ledger CTO Charles Guillemet confirmed the company is also reviewing anti-tampering protection on its devices. He advised users with potentially tampered devices to contact Ledger support for shipping instructions and offered guidelines for safely checking devices.
Ledger has stressed that its internal infrastructure, firmware code, and direct-to-consumer sales through its official store remain uncompromised. The company ordered CryptoBilis to immediately halt all sales and shipments. It is restructuring vendor verification and supply chain requirements, instructing distributors to enforce tighter tracking and source only through approved channels. Ledger is inviting researchers and other vendors to collaborate on assessing its practices.