Ledger asks resellers in seven Asian markets to halt sales over suspected $86 million wallet tampering

In an update posted on October 13, Ledger said it is asking resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to take its devices off the shelves while the investigation is ongoing.

Ledger said all confirmed losses involve devices sold through CryptoBilis, a reseller in the region. The company is still working to establish who tampered with the devices and at what point in the distribution chain it happened. It said it has no indication that its own infrastructure, systems, services or direct sales channel have been compromised.

Ledger's Donjon security team said the implant reads the 24-word recovery phrase from the device's screen during setup and sends it out over LTE. Anyone holding that phrase can restore the wallet and move its funds. Onchain investigator Specter has linked more than $86 million in suspected thefts to the compromise, a figure Ledger says it has not verified.

Earlier on Tuesday, retailer MediaMarkt Saturn stopped selling Ledger devices in its stores and online, with Ledger's agreement, after a customer in Germany reported an implant. No loss of funds was reported in that case. Ledger has not verified a drain linked to a device bought outside Southeast Asia.

Analysis

Why This Matters

Hardware wallets are marketed as secure offline storage for cryptocurrency, so a supply chain tampering incident strikes at the core of the trust users place in them.
The suspected drain of more than $86 million would be one of the larger wallet compromises in recent memory, and the actual figure is still unverified.
Anyone who set up a compromised device may have exposed their recovery phrase, meaning the incident could affect funds that have not yet been moved.

Background

Hardware wallets are physical devices designed to keep cryptocurrency private keys offline, away from internet-connected systems that hackers can target. During setup, the device displays a 24-word recovery phrase that can restore a wallet if the device is lost or broken. If that phrase is captured and transmitted without the user's knowledge, an attacker gains full control of the wallet. This case appears to involve tampering somewhere in the distribution chain rather than a breach of Ledger's own systems, which the company says it has no indication was compromised.

Key Perspectives

Ledger: The company is cooperating with retailers, pulling affected markets' stock, and says its own infrastructure and direct sales channel show no signs of compromise. It has not yet identified who tampered with the devices or where in the chain it happened. MediaMarkt Saturn: The German retailer suspended sales of Ledger devices after a customer reported an implant, acting as a precaution even though no funds were lost. Critics/Skeptics: The $86 million figure comes from an outside onchain investigator and has not been verified by Ledger, leaving uncertainty about the true scale of losses. There are also open questions about how widely tampered devices were distributed and whether other resellers beyond CryptoBilis were affected.

What to Watch

Ledger's investigation into where in the distribution chain the implants were inserted, which will determine how many devices may be affected.
Whether any confirmed losses emerge outside Southeast Asia, which would broaden the scope of the recall.
User reports of drained wallets, which could firm up the actual loss figure beyond the unverified $86 million estimate.

Analysis

Why This Matters

Background

Key Perspectives

What to Watch

Sources