Ledger has acknowledged that certain hardware wallets distributed through Southeast Asian reseller CryptoBilis were physically altered before reaching customers, in an incident that drained victims' cryptocurrency holdings — a rare case of a hardware-wallet vendor confirming a supply-chain implant rather than a firmware flaw or phishing campaign.
As reported by BleepingComputer, which carried the confirmation, the compromised devices were fitted with an additional hardware component that surveilled users and enabled theft of funds. No software exploit of Ledger's firmware was necessary; the attack defeated the device's security model at the point of manufacture or distribution, before the hardware ever reached its owner.
The characterisation of the tampering as a "hardware implant" does not suggest that Ledger's cryptographic architecture itself was broken. The underlying reality is this: a hardware wallet's security guarantee rests on the assumption that the device in your hand is the device the vendor built — an assumption that tampering during distribution (chain-of-custody compromise) invalidates entirely.
What affected users should do
Ledger's disclosure, as reported, does not yet include a complete list of affected serial numbers or a clear batch cut-off point, and that guidance may be updated — users should re-check Ledger's official support pages for any subsequent list or batch detail. In the meantime, buyers who acquired a Ledger device through CryptoBilis or other Southeast Asian distribution channels should not assume their unit is unaffected on the basis of an approximate purchase date alone.
The primary remediation path Ledger has historically recommended for devices of uncertain provenance is to treat the seed phrase as potentially exposed: set up a fresh device, generate a new recovery phrase, and transfer assets to the new wallet — never entering the old seed into any device or website of uncertain origin. Ledger Live includes a device-authenticity check that flags units not manufactured by Ledger; users concerned about provenance should run it and consult Ledger's official support pages for current guidance on this specific incident. Any verification tool should be obtained directly from Ledger's own site, not downloaded via untrusted intermediaries or links circulating on forums and messaging apps.
BleepingComputer's report does not include a statement from CryptoBilis. Ledger, per the report, is working with authorities in connection with the incident.
Why this case matters beyond one reseller
The incident is notable less for its scale than for its category. Most hardware-wallet compromises disclosed to date have involved seed-phrase phishing, malicious firmware, or exploitation of specific device models. A confirmed physical implant targeting devices in the distribution channel requires no vulnerability in the product at all — only access to the supply chain between factory and customer.
That distinction matters for anyone procuring security-critical hardware through regional distribution networks rather than direct from the vendor. For IT professionals in Hong Kong and Macau, the practical takeaway is a general one: when a device's entire value rests on the integrity of its internals, provenance is part of the security boundary. Devices acquired through third-party resellers, marketplaces, or secondary-market sales carry an inherent verification gap that no amount of firmware signing or secure-element design can close. Purchasing direct from the vendor, or from authorised channels with documented custody, remains the only way to preserve that guarantee.
Ledger's own guidance should be treated as the authoritative source for affected units and remediation steps; this report reflects the vendor's confirmation as relayed by BleepingComputer and does not extend the incident's scope beyond what Ledger has stated.
Ledger 已承認，部分經東南亞分銷商 CryptoBilis 發售的硬件錢包在送達客戶之前曾遭人為改裝，該事件導致受害者的加密貨幣資產被盜——這是硬件錢包廠商罕有地證實屬供應鏈植入事件，而非韌體漏洞或釣魚攻擊。
據 BleepingComputer 的報道（該媒體取得了官方確認），被動過手腳的設備被加裝了額外的硬件元件，用以監察用戶並竊取資金。攻擊並不需要利用 Ledger 韌體的任何軟件漏洞；而是在生產或分發環節、硬件尚未到達最終用家手上之前，便已繞過了裝置的安全模型。
將此次改裝定性為「硬件植入」，並不代表 Ledger 的加密架構本身被攻破。問題的實質在於：硬件錢包的安全保證，取決於一個假設——你手中的裝置就是廠商原廠製造的那一部。而分發過程中的改裝（即保管鏈 chain-of-custody 遭到破壞），會令這個假設徹底失效。
受影響的用戶應該怎樣做
根據報道，Ledger 現階段的披露尚未包含完整的受影響序號清單，也沒有明確的批次分界點，相關指引日後可能會更新——用戶應重新查閱 Ledger 官方支援頁面，留意後續公布的清單或批次詳情。與此同時，經 CryptoBilis 或其他東南亞分銷渠道購入 Ledger 設備的買家，不應僅憑大約的購買日期便假定自己的裝置不受影響。
對於來歷不明的設備，Ledger 過往建議的首要補救方法是將種子詞（seed phrase）視作已可能外洩：設定一部全新設備，產生新的復原詞（recovery phrase），然後將資產轉移到新錢包——切勿在任何來歷不明的設備或網站上輸入舊的種子詞。Ledger Live 內置裝置真偽檢查功能，會標示並非由 Ledger 原廠製造的設備；對裝置來歷有疑慮的用戶應執行此檢查，並查閱 Ledger 官方支援頁面，以獲取就本次事件的最新指引。任何驗證工具均應直接從 Ledger 官方網站取得，切勿透過不可信的中介或在論壇、通訊應用中流傳的連結下載。
BleepingComputer 的報道未有 CryptoBilis 的回應。根據報道，Ledger 正與執法部門就該事件進行合作。
為何此事的意義不止於單一分銷商
是次事件值得注意之處，與其說在於規模，不如說在於其類型。迄今為止，大多數對外披露的硬件錢包入侵事件，均涉及種子詞釣魚、惡意韌體，或針對特定型號設備的漏洞利用。而針對分銷渠道中的設備、經證實的實體植入攻擊，根本不需要產品本身存在任何漏洞——只需能夠接觸工廠與客戶之間的供應鏈即可。
對於任何透過區域分銷網絡、而非直接向廠商採購保安關鍵硬件的人而言，這項區別意義重大。對香港及澳門的 IT 專業人士來說，實務上的啟示具有一般性：當一部裝置的全部價值取決於其內部元件的完整性時，來歷（provenance）本身就是保安邊界的一部分。透過第三方經銷商、電子市集或二手市場購入的設備，存在一個固有的驗證缺口，無論多少韌體簽署（firmware signing）或 secure element 設計，都無法彌補。直接向廠商購買，或透過有文件記錄保管鏈的授權渠道購買，仍然是維持該項保證的唯一途徑。
Ledger 自身的指引應被視為就受影響設備及補救步驟的權威資訊來源；本報道反映的是廠商經 BleepingComputer 轉述的確認內容，並未將事件範圍擴大至 Ledger 所述以外。