Ledger hardware wallets have been at the center of a growing supply chain security crisis following the discovery of compromised devices at multiple authorized resellers.
The breach initially involved wallets purchased from Southeast Asian reseller CryptoBilis, but the list of compromised vendors has now expanded to four. MetaPod, a reseller operating in Asian international airports including Hong Kong and Malaysia, sold Ledger Flex devices confirmed to contain malicious code. Challenger, a Singaporean retailer with a location in VivoCity, was also found to be the source of a tampered Ledger Flex.
Two European retailers have also been implicated. MediaMarkt Saturn confirmed the sale of an infected device, while a device from MediaMarkt Trier is under investigation for tampering. Both shops source their Ledger products from the European electronics distributor Aqipa GmbH, which has supplied Ledger devices in Germany and Austria since August 2023.
All four retailers are officially listed as legitimate distributors on Ledger's website. In response to the breaches, both CryptoBilis and MediaMarkt/Saturn have been suspended from offering Ledger sales and shipping services.
Broader Security Concerns
The Ledger attack involved malicious implants introduced after production and was allegedly enabled by an ownership change at CryptoBilis in early August. The incident has drawn criticism for Ledger's security response, with analysts noting that independent researchers identified the threat before the company did.
The Ledger compromise is one of several hardware wallet security incidents in 2026. In July, hackers exploited a software bug in Coldcard wallets, resulting in approximately $116 million in losses. Tangem wallets were subjected to a laser fault-injection experiment, though no funds were lost. SafePal and Trezor's third-party shipping networks leaked thousands of customer personally identifiable information in August.
