Hardware wallets, once regarded as a crucial line of defense for safeguarding crypto assets, are now facing a stress test of trust. The Ledger supply chain attack controversy is testing not only its own brand reputation but also the foundation of security trust on which the entire hardware wallet industry depends for survival.
Author: Nancy, PANews
The Ledger supply chain attack incident continues to escalate. As more cases of abnormal devices come to light and potentially risky resellers surface, this security storm triggered by third-party distribution channels is steadily expanding. Although Ledger claims that its own systems and direct sales channels have not been affected, the incident has pushed the supply chain security issue of hardware wallets into the spotlight.
What is more alarming than the coin theft incident itself is that user trust is wavering. Hardware wallets, once regarded as an important line of defense for safeguarding crypto assets, are now facing a trust stress test. This crisis tests not only Ledger's brand reputation, but also the foundation of security trust on which the entire hardware wallet industry depends for survival.
Ledger Supply Chain Attack Suspicion Widens, Security Personnel Admit Attackers Are Highly Skilled
As more abnormal samples and potentially risky channels emerge, the scope of impact of Ledger's supply chain security crisis is drawing increasing attention.
On October 11, crypto analyst Darkfost posted that after the CryptoBilis-related security incident was exposed, other potentially risky resellers also appeared in community discussions, including some merchants on the Lazada platform. At present, Ledger still cannot confirm whether CryptoBilis is the only sales channel involved in the risk. Considering that some resellers are regionally connected, Darkfost believes that the possibility of multiple channel supply chains being compromised at the same time cannot be completely ruled out.
Based on information disclosed by the community, he compiled a list of "potentially risky Ledger resellers," involving more than 20 resellers. Although the related risks have not yet been confirmed, he still reminded users that if they have purchased a Ledger hardware wallet through the channels listed in the past 6 months, they should carefully assess the security of the device and consider migrating assets to a new secure device.
At the same time, suspected related cases have appeared one after another in Asia, South America, and Europe, further intensifying market concerns about the scope of the attack. Security researcher Johannes disclosed that a user discovered unauthorized implanted hardware components inside a hardware wallet several weeks after purchasing it from an official Ledger reseller in Europe. Johannes said that the implant appears to use an earlier design, while newer versions of the implanted components may be hidden behind the screen, making detection even more difficult.
The range of device models suspected of hardware tampering is also expanding. In addition to the mainstream product Ledger Nano X, the high-end flagship model Ledger Stax has also been reported to have suspected hardware tampering. Twitter user @Wentrre, after disassembling their Ledger Stax, found an extra small board on the motherboard, as well as a cellular communication module labeled Nordic nRF9151, and there were also suspected antenna wires inside the device. Because these structures raised security concerns, the user subsequently asked Ledger whether the device was abnormal.
In response, Cosine, founder of the security firm SlowMist, published a disassembly comparison image, pointing out that the abnormal sample contained an additional communication module and suspected antenna wires, while the reference images of the official genuine Stax did not show these structures. Cosine stated bluntly that in this Ledger backdoor implantation incident, the people involved can be called masters of "hardware hacking."
As more cases are exposed, market concerns about the security of hardware wallets continue to intensify. Some users said they no longer dare to power on the Ledger wallet they just bought and can only shelve it for now; others choose to disassemble the device themselves and publish internal photos, seeking help from the community and security researchers for verification, and many disassembly tutorials have also appeared on social platforms.
Who could have imagined that hardware wallets, originally regarded as an important line of defense for protecting private keys and isolating online risks, would now leave users needing to reconfirm whether the device itself is trustworthy.
All Disclosed Coin Theft Cases Involve CryptoBilis, Multiple Hardware Wallet Companies Respond Urgently
Facing this black swan event involving nearly $100 million, in the early hours of October 12, Ledger released a 72-hour update on the CryptoBilis incident, disclosing the latest investigation progress and subsequent response measures.
Ledger said the company is cooperating with relevant law enforcement agencies in the investigation, has currently confirmed a limited number of affected devices, and has proactively contacted the relevant users. It recommends that affected users contact Ledger customer service through official channels and report the case to local law enforcement.
Ledger also emphasized that as of the time of the announcement, all confirmed cases of stolen funds involved devices sold through CryptoBilis, and the company's own systems and direct sales channels were not affected. CryptoBilis has now confirmed that it has stopped selling all hardware wallets.
For potentially affected users, Ledger specifically reminded them not to initialize related devices that have not yet been used; if the device has already been set up, assets should be transferred to a new device obtained through official channels, and a brand-new mnemonic phrase should be generated using the new device.
In terms of follow-up response, Ledger said it will continue to review and strengthen distribution controls and anti-tampering processes, while requiring distributors to purchase products only through authorized channels and never to relist returned goods for sale. It also called on users to avoid buying hardware wallets through unauthorized channels to reduce the risk of purchasing tampered or counterfeit devices.
It is worth noting that CryptoBilis does not only sell Ledger. As the incident continues to unfold, hardware wallet brands such as OneKey, SafePal, Trezor, and Tangem have also responded one after another.
OneKey founder Yishi said that no reports of related device damage have been received so far, but the company has terminated CryptoBilis's authorized reseller status and is providing free replacement services for users who purchased related products through that channel. At the same time, OneKey announced that it will suspend the addition of new resellers and comprehensively re-audit its existing distribution channels. For resellers whose business entities or ultimate beneficiaries cannot be verified, the company will revoke their authorization and plans to publish a complete list of authorized resellers after the review is completed.
SafePal said it has noticed reports of asset theft involving Ledger devices purchased through CryptoBilis and is closely following the progress of the incident. In response to users' concerns about supply chain security, SafePal introduced the multiple protection mechanisms currently in place for its hardware wallets, including verifying the authenticity and usage status of the device during initial setup, issuing warnings for devices that have previously been activated and displaying the first activation date, and identifying whether the packaging has been opened through tamper-evident seals. SafePal reminded users that if they find any abnormal inspection results, they should immediately stop using the device and contact the official team.
Trezor also said it is actively investigating the CryptoBilis reseller security incident, and there is currently no indication that its devices have been affected. As a precautionary measure, Trezor has removed CryptoBilis from its list of authorized resellers and stopped selling products through that channel. At the same time, Trezor reminded users not to disassemble the device themselves to avoid damage; for the Safe 7 with a built-in battery, users should also pay attention to additional related safety risks.
Tangem responded to external concerns from the perspective of product design. The company said its card-style hardware wallet adopts an integrated sealed design of a secure chip and NFC antenna. Private keys are generated inside the chip and transaction signing is completed within it, without leaving the chip; device firmware cannot be modified after being written at the factory, and users can also verify device authenticity and first activation status through the Tangem App. It emphasized that regardless of whether users purchase through the official store, a reseller, or other channels, as long as the App verifies that the device is genuine, it can ensure that the private key is controlled only by the user, including devices purchased through CryptoBilis.
imKey also issued a statement saying that as of now, it has not received any feedback related to abnormal imKey devices or asset losses connected to this incident. Out of caution, imKey will further verify its authorized distribution channels and take necessary measures based on the verification results to reduce channel risks.
From these responses, it can be seen that manufacturers are trying to respond to market doubts about device security through channel rectification, explanations of product security mechanisms, and user risk warnings. These statements may alleviate users' anxiety to a certain extent, but they may not be enough to quickly repair the trust that has already been damaged.
For hardware wallet manufacturers, truly emerging from the crisis still requires more convincing practical actions, including transparent and verifiable investigation results, clear risk screening and handling plans, and supply chain controls and anti-tampering measures that can withstand scrutiny.