Ledger hardware wallets have been trending in recent times following the theft of about $93 million in a supply chain attack.
As CoinPedia reported, the incident initially involved crypto wallets purchased from Southeast Asian reseller CryptoBilis.
New information has now come to light, with the list of compromised resellers growing to four.
Breached Ledger vendors list
The first is MetaPod, a reseller primarily located within Asian international airports, including those in Hong Kong and Malaysia. A Ledger Flex purchased from this vendor has been confirmed to be infected with malicious code.
The second is Challenger, a Singaporean retailer whose VivoCity shop was found to be the origin of a tampered Ledger Flex. CryptoQuant analyst Darkfost had initially flagged this reseller as high-risk due to geographical proximity to CryptoBilis.
Third on the list is the European retailer MediaMarkt Saturn, with a device purchased here confirmed infected. One more device from a similar retailer, MediaMarkt Trier, is being investigated for interference. Both shops obtain their Ledger products from the European electronics distributor Aqipa GmbH, which has been supplying Ledger devices in Germany and Austria since August 2023.
Notably, all the above shops are officially listed on Ledger’s website as legitimate distributors. In addition to CryptoBilis, MediaMarkt/Saturn has also been suspended from offering Ledger sales and shipping services.
Below is a list of additional Ledger resellers to watch for, on the basis of geographical proximity and a shared entity in the supply chain system, such as Aqipa.
Source: Darkfost
Ledger critics
Darkfost accused Ledger of slow security responses since other on-chain analysts identified the threat before the company. He added that random X accounts were also providing better Ledger wallet security checkups than the French company itself. Even more, Ledger did not offer to cover shipping fees for recalled devices.
Hardware wallet attacks surpass $200 million in 2026
The Ledger attack involved implants introduced post-production and was allegedly enabled by the early August covert change in CryptoBilis ownership.
A bigger attack happened in July, with $116 million drained from Coldcard wallets after hackers exploited a software bug.
And while the Tangem wallet suffered zero losses in a recent laser fault-injection experiment, the event still shattered its “unhackable” narrative. Ironically, Donjon, Ledger’s security research team, discovered the flaw.
Meanwhile, SafePal and Trezor’s third-party shipping network leaked thousands of personally identifiable customer information in August.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
