Ledger has confirmed that at least one of its hardware wallets was physically tampered with before reaching a customer, following a wave of loss reports from buyers of Asian retailer CryptoBilis. The confirmation, posted by Ledger on X, marks the first time the company has verified that manipulated devices from this channel reached end users.
According to Ledger, the device in question contained an unauthorized hardware implant. Investigations into the affected unit show that additional electronics built into the device are capable of capturing information displayed on the screen, including the recovery phrase shown during the initial setup process. That phrase is the single piece of information that grants full control over the funds stored on a wallet.
Multiple customers of CryptoBilis had reported losing their cryptocurrencies before Ledger opened its investigation. The company has since warned customers against setting up or using any device purchased through that retailer. CryptoBilis has halted sales of all hardware wallets until the investigation is concluded.
Ledger said it found no evidence that the compromise originated within its own systems. "We have no indication that Ledger's security infrastructure, systems, or services have been compromised," the company said. Ledger also reiterated a standing security principle for owners of any of its devices: "Ledger will never ask for your 24-word recovery phrase."
German buyers report similar devices
The case has taken on a wider European dimension after a user posted on X over the weekend describing suspected manipulated Ledger wallets bought through German retail channels. One of the devices in question was reportedly bought new at MediaMarkt, a major consumer electronics chain with stores across Germany and other European markets.
Ledger has not established a link between the reports from Germany and the confirmed cases tied to CryptoBilis. The two sets of reports remain, for now, separate strands of the same broader concern: that hardware wallets can be intercepted and altered somewhere between manufacture and purchase, regardless of which retailer sells them.
For buyers who purchased a device through CryptoBilis and have not yet set it up, Ledger advises against doing so. Customers who have already configured such a wallet and used it to store cryptocurrency are advised to transfer their holdings to a new device set up with a freshly generated seed phrase, rather than continuing to rely on the potentially compromised unit.
The episode underscores a recurring risk in the hardware wallet market: the security of a device depends not only on its design but on the integrity of the supply chain that delivers it to the customer. For buyers in Germany and elsewhere in Europe, the emergence of suspect units sold through a mainstream retailer raises the stakes of that risk beyond smaller or less-regulated sales channels.
