Supply Chain Vulnerabilities
Ledger is reviewing its sales policies and how its devices reach customers after the Cryptobilis incident, in which physical tampering along its supply chain led to $93 million in cryptocurrency theft from user wallets, according to a report on October 13. The company’s CTO confirmed that it is also reviewing anti-tampering protection on its devices following the incident and advised affected users to contact support for examination instructions.
Ledger's CEO noted that physical supply chain tampering is an industry-wide risk, confirming plans to review controls for direct sales and resellers. The company is inviting researchers and other vendors to collaborate in assessing chain-of-custody and tamper detection practices.
The Attack Vector
The incident was noticed when wallets drained simultaneously across multiple blockchain networks. Investigations revealed that affected wallets had been procured from CryptoBilis, an authorized third-party reseller covering Malaysia and Southeast Asia. Ledger ordered the reseller to immediately halt all sales and shipments.
Ledger discovered an unauthorized hardware implant equipped with a cellular module inside an affected user's device. Attackers manually installed the chips in brand-new devices within the supply chain, allowing them to record recovery seed phrases during initial setup.
Impact and Response
The integrated cellular chip transmitted the unencrypted recovery phrase over LTE networks directly to external servers, granting remote access to clone private keys and drain funds. This hardware modification bypassed standard automated software protocols because it operated outside the microchip running the standard firmware.
Ledger stressed that its internal infrastructure, firmware code, and direct-to-consumer sales channels remain uncompromised. The company advised users with wallets from third-party resellers to transfer funds to a newly secured wallet while it restructures its vendor verification and supply chain requirements.
