Compromised Ledger Resellers List amid 2026’s $200M Cold Wallet Theft

Ledger hardware wallets have been trending in recent times following the theft of about $93 million in a supply chain attack.

As CoinPedia reported, the incident initially involved crypto wallets purchased from Southeast Asian reseller CryptoBilis. 

New information has now come to light, with the list of compromised resellers growing to four. 

Breached Ledger vendors list

The first is MetaPod, a reseller primarily located within Asian international airports, including those in Hong Kong and Malaysia. A Ledger Flex purchased from this vendor has been confirmed to be infected with malicious code.

The second is Challenger, a Singaporean retailer whose VivoCity shop was found to be the origin of a tampered Ledger Flex. CryptoQuant analyst Darkfost had initially flagged this reseller as high-risk due to geographical proximity to CryptoBilis.

Third on the list is the European retailer MediaMarkt Saturn, with a device purchased here confirmed infected. One more device from a similar retailer, MediaMarkt Trier, is being investigated for interference. Both shops obtain their Ledger products from the European electronics distributor Aqipa GmbH, which has been supplying Ledger devices in Germany and Austria since August 2023.

Notably, all the above shops are officially listed on Ledger’s website as legitimate distributors. In addition to CryptoBilis, MediaMarkt/Saturn has also been suspended from offering Ledger sales and shipping services. 

Below is a list of additional Ledger resellers to watch for, on the basis of geographical proximity and a shared entity in the supply chain system, such as Aqipa.

Source: Darkfost

Ledger critics 

Darkfost accused Ledger of slow security responses since other on-chain analysts identified the threat before the company. He added that random X accounts were also providing better Ledger wallet security checkups than the French company itself. Even more, Ledger did not offer to cover shipping fees for recalled devices.

Hardware wallet attacks surpass $200 million in 2026

The Ledger attack involved implants introduced post-production and was allegedly enabled by the early August covert change in CryptoBilis ownership.

A bigger attack happened in July, with $116 million drained from Coldcard wallets after hackers exploited a software bug.

And while the Tangem wallet suffered zero losses in a recent laser fault-injection experiment, the event still shattered its “unhackable” narrative. Ironically, Donjon, Ledger’s security research team, discovered the flaw.

Meanwhile, SafePal and Trezor’s third-party shipping network leaked thousands of personally identifiable customer information in August.