Ledger halts reseller sales across seven Asian markets while investigating tampered hardware wallets
Ledger ordered resellers in Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia and Hong Kong to stop sales and pull devices after discovering hardware implants that steal recovery phrases.
Why it matters
The incident exposes a supply-chain attack that bypasses Ledger's Genuine Check because the Secure Element remains intact, raising questions about hardware wallet verification methods and prompting a broader industry pullback from third-party resellers.
Where the sources disagree
Estimated financial losses from CryptoBilis-sold devices
up to $93.4 million
Bitcoin.com News
$86 million
Protos, Decrypt
Bitcoin.com News reports up to $93.4 million in suspected losses, while Protos and Decrypt cite an $86 million hack; Ledger says many circulating figures are unverified.
Key facts
Ledger asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove devices from shelves on October 13, 2026.
Reported by Cointelegraph
The tampering involves a physical implant that reads the 24-word recovery phrase during device setup and transmits it over LTE via an eSIM, without modifying the Secure Element or Ledger operating system.
Reported by Crypto News (CryptoNews.net)
Ledger's Genuine Check cannot detect this type of implant if the original Secure Element remains intact.
Reported by Crypto News (CryptoNews.net)
MediaMarkt Saturn stopped selling Ledger devices in stores and online on October 13 after a customer in Germany reported an implant; no fund losses were reported in that case.
Reported by Crypto News (CryptoNews.net)
Ledger said it has no indication its infrastructure, systems, services or direct sales channel have been compromised.
Reported by Cointelegraph
Trezor has reduced its number of resellers as a preventative step following the Ledger incident.
Reported by Cointelegraph
What happened
Ledger has suspended sales through resellers and distributors in six Southeast Asian countries plus Hong Kong while its Donjon security team investigates hardware wallets fitted with a hidden implant that reads the 24-word recovery phrase during setup and transmits it via an eSIM over LTE. The request, posted on X on October 13, expands an earlier halt targeting Malaysian reseller CryptoBilis after devices sold there were linked to crypto thefts. Ledger says confirmed incidents remain contained to Southeast Asia, it has not verified any drain tied to devices bought elsewhere, and its own infrastructure, systems, services and direct sales channel show no sign of compromise. Separately, European retailer MediaMarkt Saturn stopped selling Ledger devices on October 13 after a customer in Germany reported an implant, though no fund loss occurred in that case. Rival wallet maker Trezor has also reduced its reseller count as a precaution. Reported loss estimates differ: Bitcoin.com News cites up to $93.4 million tied to CryptoBilis devices, while Protos and Decrypt reference an $86 million hack; Ledger says many figures circulating are unverified. The company has not set a date to resume sales in the affected markets.
How the story developed
- Update
Initial reports of stolen crypto linked to CryptoBilis devices surface
Users report crypto thefts tied to Ledger devices purchased through Malaysian reseller CryptoBilis.
- Update
MediaMarkt Saturn pauses Ledger sales in Germany
European retailer stops sales after a customer reports an implant in a device; no fund losses reported.
- Official statement
Ledger expands sales halt to seven Asian markets
Company posts on X requesting resellers in Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and pull inventory.
- Update
Ledger technical update details implant mechanism
Donjon security team finds implant reads recovery phrase during setup and transmits via LTE eSIM; Genuine Check cannot detect it if Secure Element is intact.
- Update
Trezor reduces reseller count as precaution
Rival hardware wallet maker announces reseller reduction following Ledger tampering reports.
- First report
First report by Cointelegraph
Ledger asks resellers to halt sales in Southeast Asia and Hong Kong
- Official statement
Official statement from Bitcoin.com News
Ledger Wallets Taken off Shelves in 7 Asian Markets as Spy Chip Probe Deepens
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 13 Oct 2026, 23:28 UTC: Cointelegraph — 1 independent source, 1 reports
- 14 Oct 2026, 04:44 UTC: Crypto News (CryptoNews.net) — 2 independent sources, 2 reports
- 14 Oct 2026, 10:05 UTC: Bitcoin.com News, official — 3 independent sources, 3 reports
- 14 Oct 2026, 10:32 UTC: Unchained — 4 independent sources, 4 reports
- 14 Oct 2026, 12:01 UTC: Protos — 5 independent sources, 5 reports
- 14 Oct 2026, 13:47 UTC: Decrypt — 6 independent sources, 6 reports
Affected entities
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | Ledger Wallets Taken off Shelves in 7 Asian Markets as Spy Chip Probe Deepens | Independent | |
| Cointelegraph Crypto media | Ledger asks resellers to halt sales in Southeast Asia and Hong Kong | Original | |
| Unchained Crypto media | Ledger Wallets Come Off Shelves at MediaMarkt Saturn and Resellers Across Southeast Asia | Independent | |
| Decrypt Crypto media | Ledger Asks Resellers in Seven Asian Markets to Pull Devices After Suspected $86M Drain | Independent | |
| Protos Crypto media | Ledger asks more Southeast Asia resellers to halt wallet sales | Independent | |
| Crypto News (CryptoNews.net) Aggregator | Ledger Asks Resellers to Halt Sales in Seven Asian Markets | Syndicated |
Related events
Ledger halts German retail sales and Southeast Asia distribution after hardware wallet tampering discovered
Ledger suspended sales in Germany and Southeast Asia after discovering hidden implants in hardware wallets that steal recovery phrases; Trezor tightened its reseller network as a precaution.
US Treasury Sanctions Iranian Exchange BitBank Over Bitcoin Transfers to IRGC
The US Treasury sanctioned Iranian crypto exchange BitBank, its software developer and three associates, alleging it moved hundreds of millions of dollars in bitcoin to Iran's IRGC.
White hats move 52.37 bitcoin from Coldcard exploit wallets into Wyoming recovery trust
White-hat hackers moved 52.37 BTC tied to July's Coldcard hardware wallet exploit into a Wyoming-based Crypto Recovery Trust address, Galaxy Digital said.
OpenAI launches Dots, always-on AI agents with their own cloud computers, at DevDay
OpenAI launched Dots, always-on agents running on their own cloud computers, at DevDay 2026 in San Francisco, a day after pulling the GPT-6.1 Astra flagship.
Green Dot Bank Tightens Apple Cash ID Rules From Nov. 9 and Keeps Its Crypto Transaction Ban
Apple told users that from Nov. 9 unverified Apple Cash accounts cannot reload balances, while Green Dot Bank's ban on cryptocurrency transactions stays in its updated terms.