Binance co-founder Changpeng Zhao (CZ) has called on cryptocurrency investors to enforce a mandatory “quarantine” period for new hardware wallets, following a major security breach in Southeast Asia that led to investors losing over $86 million. The incident highlighted a shift in criminal tactics, with hackers now targeting the physical supply chain instead of searching for digital vulnerabilities.
CZ’s call for caution after Southeast Asia hardware wallet attacks
Physical device tampering became a central concern after a compromised local distributor of Ledger wallets caused widespread losses in Malaysia, Indonesia, and the Philippines. On-chain researchers traced substantial outflows, amounting to $86.9 million, via the Bitcoin, Ethereum, and Tron networks from hundreds of affected wallets.
Ledger, a leading provider of hardware wallets, responded by suspending sales through its reseller CryptoBilis. The company explained that attackers had intercepted devices at intermediate warehouses and replaced original documentation with tampered seed phrases, while its own production facilities, firmware, and the Ledger Live application remained secure.
Recent buyers, especially those who acquired wallets in the last 90 days, were instructed not to activate their devices and to swiftly transfer their assets to new addresses if they suspected any compromise. Ledger clarified that only the logistics chain at CryptoBilis was targeted, not the entire supply line.
Industry-wide surge in delivery-chain threats
The Ledger attack was not isolated. In August, Coinkite, the manufacturer behind Coldcard hardware wallets, reported breaches at third-party distributors that undermined device security. The following month, leading hardware wallet maker Trezor disclosed a serious data breach caused by its logistics contractor, ShipMonk, impacting 80,000 U.S. customers. The breach exposed confidential personal information including real names, phone numbers, and home addresses, sparking privacy concerns across the user community.
As the risks associated with local marketplaces and third-party distributors came under scrutiny, major market participants began to change their approach. Large cryptocurrency holders are increasingly ordering wallets directly from manufacturers, utilizing neutral delivery locations such as PO boxes, and adopting a “quarantine” protocol similar to that recommended by CZ.
CZ explains the logic behind the “quarantine” strategy
CZ, a prominent figure in the digital asset industry, stated that crypto investors should avoid immediately transferring funds to new addresses after acquiring hardware wallets or downloading wallet software. Instead, he advised letting the device remain unused for at least two weeks and staying vigilant for any security alerts during this period. According to CZ, this window allows on-chain analysts time to detect thefts linked to potentially compromised shipments. If widespread hacks occur, the delay increases the chance that affected devices will be identified and public warnings issued before further losses.
CZ emphasized the importance of risk management for hardware wallet users, saying that self-custody comes with extra responsibility and exposure to attacks on both physical devices and online platforms. He added that thorough monitoring can help prevent large-scale losses when delivery-chain attacks occur.
Major hardware wallet providers like Ledger, Trezor, and Coinkite have encouraged customers to strengthen their device security practices and avoid purchasing through unofficial or local channels.
The surge in delivery-related attacks has prompted renewed efforts in the hardware wallet sector to reinforce packaging, improve distributor vetting, and educate users about safe onboarding procedures.
Experts consider the introduction of a quarantine period as an additional defense layer, aiming to complement other best practices in digital asset storage and self-custody.
Mini dictionary: Ledger is a French company that manufactures hardware wallets for securely storing cryptocurrencies offline. Hardware wallets are physical devices, often resembling USB drives, designed to keep private keys and digital assets out of reach from online attacks.
| Company | Incident | Compromised Data | Action Taken |
|---|---|---|---|
| Ledger | Physical tampering via distributor CryptoBilis | Seed phrases replaced | Suspended sales, advised quarantine and urgent transfers |
| Coinkite (Coldcard) | Third-party distributor compromise | Device security threatened | Security alert issued |
| Trezor | Logistics contractor (ShipMonk) breach | Customer personal information | Disclosed breach, user warnings |
