What actually happened?
Hardware wallet maker Ledger on Tuesday, according to Kryptonovinky.cz and Kryptonovinky.sk, published an analysis of an attack on its devices that reached customers through the reseller CryptoBilis. According to Ledger's security team, known as Donjon (as both Kryptonovinky outlets cite its findings), a physical implant, a small chip with a microcontroller, was hidden inside the device packaging. It was meant to monitor what appeared on the wallet's display. The moment the recovery phrase showed up during initial setup, the implant was supposed to capture it and send it away over a mobile network.
An important clarification about sources: the charliedesk editorial team did not read Ledger's and Donjon's primary analysis from a direct Ledger source, but knows it secondhand through the Kryptonovinky reporting. We therefore present the description of the attack as what Ledger says Donjon found, not as an independently verified technical finding.
The recovery phrase (in English the seed phrase, typically 24 words) is the master key to the entire wallet. Whoever has it controls the funds. That is exactly why this is so sensitive: the described attack does not target the software or the encryption, but the physical path of the device from manufacturing to the customer, in other words the so-called supply chain.
Why is this a supply chain problem, and not (just) one manufacturer's problem?
What matters is how the malicious component got into the device. According to the description, this was not a flaw in the wallet's design, but tampering with the goods before the customer had them in hand. That shifts the perspective: the weak point is not necessarily the product itself, but the distribution (resellers, repackaging, intermediate warehousing).
This very dimension explains why a competitor is also reacting to the disclosure. According to CryptoSlate and Cointelegraph, Trezor's Chief Commercial Officer (CCO) Danny Sanders sent out a letter dated October 13, informing selected partners that as of January 1, 2027 they will lose their authorized reseller status. Trezor, per CryptoSlate, frames this as tightening oversight of its own supply chain and as a preventive step.
What exactly is Trezor changing?
| What | Detail | Source |
|---|---|---|
| Form of the decision | Letter from CCO Danny Sanders dated October 13 | CryptoSlate, Cointelegraph |
| Who it affects | Selected authorized resellers (not all) | CryptoSlate, Cointelegraph |
| Effective when | Authorization revoked as of January 1, 2027 | CryptoSlate |
| Reason | Tightening supply chain control, prevention | CryptoSlate |
According to CryptoSlate, Trezor stated that it found no evidence of tampering with its own devices. This is therefore a preventive narrowing of the reseller pool, not a reaction to an implant found in its own products.
And what about those missing listings?
Both the Czech and Slovak Kryptonovinky report that Ledger wallets are disappearing from part of the retail offering; the Slovak version specifically mentions MediaMarkt stores. The scope of this withdrawal, whether it is a temporary measure or a blanket decision and exactly which markets it concerns, does not clearly follow from the available sources. For now we file this as unverified.
What does this mean for the everyday user?
This is not advice on what to do with your money, but a description of where the risk lies in this type of incident. In a supply chain attack, what matters is the device's origin and how the recovery phrase is generated and displayed. Generally speaking, hardware wallet makers point to buying through official channels and verifying device authenticity in situations like this. The specific procedures vary by manufacturer and are not covered by these four sources, so we do not present them here as fact.
What to watch next (so it can be checked later)
- Whether Ledger will disclose the number of affected units sold through CryptoBilis and how much (if any) in funds was stolen. Unknown for now.
- Exactly how Trezor will carry out the narrowing of resellers and which partners it will affect. So far only the principle and the date have been published.
- Whether and in which markets Ledger will actually return to both brick-and-mortar and online listings, including chains such as MediaMarkt.
Charliedesk is following this case as a story about distribution, not about a failure of cryptography. As soon as verified figures come in, we will add them and let ourselves be held to account for them.