Ledger suspends wallet sales in Asian markets

TLDR

Ledger has temporarily stopped hardware wallet sales via resellers in seven Asian markets while it investigates a serious supply-chain tampering incident.

1. Ledgers pause targets resellers in seven markets after discovering hardware implants in some devices sold through CryptoBilis, with investigators estimating but not confirming losses around 86 million dollars.
2. So far Ledger says only Southeast Asia cases are confirmed and its infrastructure and direct sales channel show no compromise, highlighting a physical supply-chain attack rather than a software vulnerability.
3. Buyers in the affected markets should use official Ledger support, avoid setting up suspect devices, move funds to wallets with new recovery phrases, and monitor investigation and sales-restoration updates.

Deep Dive

1. Scope Of The Suspension

On 13 October 2026, Ledger asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove devices from shelves while it investigates tampered units, according to an official update summarised by CoinsKid Community and outlets like Decrypt.

The confirmed loss cases so far involve devices sold through Southeast Asian reseller CryptoBilis, with independent onchain investigators estimating suspected thefts in the 86 to 93 million dollar range, which Ledger has not formally verified.

Importantly, the suspension currently targets third party resellers in those markets rather than a global halt of direct sales from Ledgers own channels. There is no announced restart date.

2. Nature Of The Security Incident

Ledgers internal Donjon security team found an unauthorized hardware implant in affected devices that can read the 24 word recovery phrase during setup and send it out over LTE using an eSIM, as described in reports from Yahoo Finance and Decrypt that quote Ledgers incident update.

Ledger says the Secure Element and firmware remain intact, meaning authenticity checks or a successful genuine test do not guarantee the device is free of physical tampering, which makes this a classic supply-chain attack focused on distribution rather than core cryptography or software.

The company states it has no indication its own infrastructure, systems, services or direct sales channel were compromised, and that confirmed drain cases remain confined to Southeast Asia, though reports of suspect devices have emerged elsewhere on a precautionary basis, such as MediaMarktSaturn pausing sales in Germany and Trezor reducing reseller numbers.

3. What Users Should Do And Watch

Ledgers guidance for recent CryptoBilis buyers is clear: unused devices should not be initialized and owners should contact official support channels; devices already set up should have funds moved promptly to a new wallet secured by a completely new recovery phrase.

More broadly, users in the seven affected markets who purchased via resellers should treat any unexplained modification or non standard packaging as a red flag, avoid entering seed phrases into suspect hardware, and use support.ledger.com or official channels for case handling rather than third party links.

The next key signals to watch are Ledgers investigation findings on where in the distribution chain tampering occurred, any announced recalls or compensation frameworks, and whether hardware wallet vendors tighten reseller programs or redesign devices to make physical implants easier to detect.

Conclusion

Ledgers suspension of reseller sales in Asian markets is a targeted response to a serious supply-chain attack that abuses recovery phrases rather than breaking cryptography.

For crypto users, the episode reinforces that hardware wallets are only as safe as the path they take from manufacturer to your hands, and that diversified custody, careful sourcing and rapid migration from suspect devices are now central parts of a robust self custody strategy.

Confidence: high, because multiple consistent reports and Ledgers own statements align on the scope of the suspension and the nature of the tampering mechanism.