Someone Sold Tampered Crypto Wallets. Where You Buy Matters as Much as What.

My verdict: a hardware wallet is only as trustworthy as the hands it passed through before it reached you, and this case proves it in the most expensive way possible.

Ledger has asked CryptoBilis, a reseller based in Kuala Lumpur and listed as an official Ledger partner for Malaysia, Indonesia and the Philippines, to pause all sales and shipments while it investigates reports of drained wallets among buyers in Southeast Asia. According to The Verge, Ledger confirmed that one affected device contained an unauthorized hardware implant. Photos shared online show a small board tucked under the screen that allegedly reads whatever the screen displays, including the seed phrase during setup, and sends it out through a built-in SIM card. On-chain investigators estimate the losses at somewhere between $72 million and more than $86 million. Ledger has not confirmed a figure, says its own systems were not compromised, and says it has no reports involving devices bought directly from Ledger.

Ledger’s advice is specific. If you bought from CryptoBilis in the last 90 days, do not set the device up. If you already did, move your funds to a new device with a new seed phrase.

I have worked with crypto for several years and I still do, mostly as an investment. I never needed a hardware wallet, because my funds are not large enough to justify one. What I use is an external wallet on a separate device that never joins Wi-Fi, runs only on mobile data, and is used for nothing else. It is my master key, and that is its only job. I am not saying that setup is right for everyone. I am saying that with crypto, being careful is not optional, and attacks like this one are exactly what the care is for.

The uncomfortable part of this story is that the victims did the responsible thing. They bought a device designed to keep their keys offline, and the attack happened before the box was ever opened. The device was not the weak point. The supply chain was.

If you own a Ledger, check where it came from, and read Ledger’s guidance on spotting a tampered device. The reporting is linked below. Check it yourselves.