Malicious implants secretly embedded in Ledger hardware wallets were found to have stolen users' recovery phrases, putting trust in the distribution process under scrutiny, blockchain outlet Cointelegraph reported on Oct. 14.

The outlet said cryptocurrency losses were reported from Ledger devices sold on Oct. 9 through CryptoBilis, an authorised reseller in Indonesia, Malaysia and the Philippines. Ledger said the next day it confirmed an unauthorised malicious component in one affected device. The component was found to have collected users' recovery phrases and transmitted them over a mobile network.

Hardware wallets are designed to store private keys offline to reduce exposure to online attacks. But as sales networks expand globally, the risk of tampering at the supply-chain stage has also increased, critics say.

Hardware security expert Joe Grand (조 그랜드) said it is realistically difficult for ordinary users to detect sophisticated tampering. Grand developed a technique to extract data from memory chips in Trezor and KeepKey wallets. "Even people who are tech-savvy do not inspect devices one by one," he said. "It is really difficult to explain how people should check their devices," he said.

Cryptocurrency analyst Mati Greenspan (마티 그린스펀) said he has been in the industry since 2013 but has never used a hardware wallet. "The moment you buy a hardware wallet, a new chain of trust is created, from the manufacturer to the supplier and even the previous handler," he said.

Nick Neuman (닉 노이만), CEO of Bitcoin security company Casa, said it is impossible to completely avoid third-party trust. "There will always be an intermediary you must trust," he said, advising users to spread risk across multiple providers.

Ledger rival Trezor said its devices undergo authenticity checks and accept only signed firmware. It acknowledged such measures alone cannot rule out physical tampering. Trezor said the implant intercepted screen information without modifying firmware and that the same attack has never been observed on its devices. Trezor said on Oct. 13 it would reduce the number of resellers as a preventive measure.

Experts have suggested using transparent cases that reveal internal components, or tamper-resistant enclosures that would force an attacker to remake the entire case. But such designs can only make supply-chain attacks more difficult and cannot eliminate the risk of tampering entirely.