Unchained: treat keys from Ledger devices bought from two named resellers as compromised
Unchained reports a developing Ledger supply-chain incident: according to the company, Ledger notified it of an issue with devices distributed through a Southeast Asian reseller (CryptoBilis) and the European retail chain MediaMarkt Saturn. Unchained has not yet identified compromised Ledger devices in client vaults, and there have been no notifications of problems with devices from other sales channels. The risk is direct: a substituted or opened device means the seed may have reached third parties, putting funds held under that key at risk.
If your Ledger device was purchased through CryptoBilis or MediaMarkt Saturn, treat that key as compromised and replace it right now: generate a new seed on a trusted device obtained directly from the manufacturer and transfer funds to new addresses; for multisig, replace the corresponding key in the quorum. Ledger's statement is linked in the post.
Sources: