Ledger has told resellers and distributors in six Southeast Asian countries and Hong Kong to stop selling its hardware wallets and pull them from shelves while it investigates tampered devices.
Key Takeaways
- Ledger halted reseller sales in 7 markets on Oct. 13, including Singapore, Indonesia and Hong Kong.
- Suspected losses tied to tampered Ledger devices sold via Cryptobilis are estimated at up to $93.4M.
- The Ledger Donjon is examining returned devices, and Ledger has not set a date to resume sales in the region.
Seven Markets Go Dark
In an incident update posted Oct. 13, the French hardware wallet maker said:
[We are] asking resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices while the investigation is ongoing. This includes taking products off the shelves.
The halt covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. That is a major expansion from the original response, which targeted a single regional reseller.
Ledger was careful to limit the scope of its admission, noting that as the investigation has forged ahead, the only confirmed incidents remain contained to Southeast Asia. The company further clarified:
We have not verified a drain linked to a device bought elsewhere. There has been no indication that Ledger’s infrastructure, systems or services or direct sales channel have been compromised.
Lastly, the company said the Ledger Donjon, its in-house security research team, will analyze devices it receives so as to find out who tampered with the hardware and where in the distribution chain it happened.
How the Ledger Spy Chip Saga Got Here
The crisis went public on Oct. 9, when users reported crypto being drained from wallets bought through Cryptobilis, a reseller operating in Southeast Asia. Ledger asked Cryptobilis to pause all sales and shipments, and suspected losses have since been estimated at as much as $93.4 million.
Subsequently, on Oct. 10, Ledger confirmed a hidden hardware implant inside one affected user’s device. The implant could read the 24-word recovery phrase shown during setup and transmit it to attackers over LTE using an eSIM.
The scare then jumped to Europe and a user said he found a hidden implant in a Ledger bought at a Mediamarkt store in Germany, and former Mt. Gox CEO Mark Karpeles noted the antenna was labeled a “Eurasian version.” On Oct. 13, Mediamarkt Saturn stopped selling Ledger devices altogether, a move the company said it backed, following the report of an implant from one customer in Germany.
Ledger said no loss of funds was reported in that case.
Rival providers have been on alert too, with Trezor saying it will end some reseller partnerships from Jan. 1, 2027, to build a network “small enough that we can vet and check every partner that remains,” even as it insisted there is no evidence its own devices have been compromised.
What Ledger Buyers Should Do Now
Customers who bought from Cryptobilis in the last 90 days should not set up unused devices, and anyone who already did should move funds to a new wallet with a new recovery phrase. Users with questions about any device can reach Ledger through its official support channel.
The company also warned that scammers tend to exploit incidents like this one and subsequently posted the following warning:
“Ledger will never call you, message you directly or ask for your 24-word recovery phrase. Many claims and figures circulating online are unverified.”