TLDR
Ledger has suspended reseller sales of its hardware wallets in seven Asian markets while it investigates tampered devices linked to large crypto thefts.
- Ledger told resellers in Indonesia, Singapore, Thailand, Vietnam, Malaysia, the Philippines and Hong Kong to pull devices amid a probe into modified wallets sold via CryptoBilis.
- Investigators found a hidden hardware implant that can read a wallets 24-word recovery phrase and send it over LTE, with suspected losses estimated between about $86 million and $93 million.
- Confirmed incidents are still confined to Southeast Asia, Ledgers own infrastructure and direct sales are reported intact, and the key unknowns are who tampered with devices and where in the supply chain.
Deep Dive
1. What Ledger Halted And Why
Ledger asked resellers and distributors in seven markets to stop selling and remove its devices from shelves while an investigation into tampered hardware wallets continues, covering Indonesia, Singapore, Thailand, Vietnam, Malaysia, the Philippines and Hong Kong, according to multiple reports and a Ledger update on X cited by CoinTelegraph and CoinsKid community coverage.
The probe centers on devices sold through regional reseller CryptoBilis, after users reported funds drained from wallets linked to those units, with onchain investigators estimating suspected losses in the range of $86 million to $93 million, though Ledger has not confirmed a final total.
MediaMarkt Saturn in Germany has also paused Ledger sales after a customer reported an implant, but no losses were confirmed there, reinforcing that the main focus remains the Southeast Asian reseller channel documented in reports such as the Bitcoin.com spy chip story.
2. The Implant And Supply-Chain Risk
Ledgers Donjon security team found at least one affected device contained an unauthorized hardware implant that can read the 24-word recovery phrase from the wallet screen during setup and transmit it to attackers over LTE via an eSIM, enabling them to recreate the wallet and move funds, as detailed in Decrypts incident report and CoinMarketCaps summary of the supply-chain attack.
Crucially, Ledger says there is no indication that its own infrastructure, systems or direct sales channel were compromised; the attack appears to be physical tampering somewhere between factory and end customer, with confirmed loss cases limited to Southeast Asia so far.
The core model of offline keys still holds, but trust in reseller and distribution chains is a real vulnerability that cannot be fully checked by ordinary users.
3. What To Watch And User Implications
The key open questions are who added the implant and at what point in the distribution chain; Ledger Donjon is analyzing returned devices and Ledger has not set any timeline for resuming reseller sales in the affected markets, per the October 13 security update highlighted by CoinsKid community posts.
Other hardware-wallet makers, such as Trezor, are already tightening reseller controls as a preventive step, and analysts expect more emphasis on direct-from-manufacturer purchases, stronger anti-tamper designs, and possibly greater interest in professional custody or ETF-based exposure for some users.
For individual holders, the practical lens is simple: generate recovery phrases only on devices you initialize yourself, treat any pre-printed or shared phrase as compromised, and spread risk across multiple storage methods rather than relying on a single hardware brand or reseller channel.
Conclusion
Ledgers halt of Asian resellers is a containment move aimed at a specific supply-chain attack, not a blanket failure of its core technology or direct sales.
The investigations findings, plus how fast vendors and regulators respond on reseller controls and anti-tamper standards, will shape whether hardware wallets remain the dominant self-custody choice or cede ground to more diversified custody setups.
CoinsKid.Com