From Coinpedia · By Steve Muchoki
Story HighlightsOn October 9, Ledger wallets suffered a supply chain-enabled crypto theft with losses exceeding $90 million.
In addition to CryptoBilis, MetaPod, Challenger, and MediaMarkt retailers have been confirmed to have sold compromised Ledger devices.
Coldcard wallet drains have compounded to over $200M this year, with the threat profile expanding to bugs, brute force attacks, and data breaches.
Ledger hardware wallets have been trending in recent times following the theft of about $93 million in a supply chain attack.
As CoinPedia reported, the incident initially involved crypto wallets purchased from Southeast Asian reseller CryptoBilis.
New information has now come to light, with the list of compromised resellers growing to four.
Breached Ledger vendors list
The first is MetaPod, a reseller primarily located within Asian international airports, including those in Hong Kong and Malaysia. A Ledger Flex purchased from this vendor has been confirmed to be infected with malicious code.
The second is Challenger, a Singaporean retailer whose VivoCity shop was found to be the origin of a tampered Ledger Flex. CryptoQuant analyst Darkfost had initially flagged this reseller as high-risk due to geographical proximity to CryptoBilis.
Third on the list is the European retailer MediaMarkt Saturn, with a device purchased here confirmed infected. One more device from a similar retailer, MediaMarkt Trier, is being investigated for interference. Both shops obtain their Ledger products from the European electronics distributor Aqipa GmbH, which has been supplying Ledger devices in Germany and Austria since August 2023.
Notably, all the above shops are officially listed on Ledger’s website as legitimate distributors. In addition to CryptoBilis, MediaMarkt/Saturn has also been suspended from offering Ledger sales and shipping services.
Below is a list of additional Ledger resellers to watch for, on the basis of geographical proximity and a shared entity in the supply chain system, such as Aqipa.
Source: Darkfost
Ledger critics
Darkfost accused Ledger of slow security responses since other on-chain analysts identified the threat before the company. He added that random X accounts were also providing better Ledger wallet security checkups than the French company itself. Even more, Ledger did not offer to cover shipping fees for recalled devices.
Hardware wallet attacks surpass $200 million in 2026
The Ledger attack involved implants introduced post-production and was allegedly enabled by the early August covert change in CryptoBilis ownership.
A bigger attack happened in July, with $116 million drained from Coldcard wallets after hackers exploited a software bug.