Tampered Wallets, $86M Drama: Ledger Asks Asian Resellers to Shelve Devices 🔍

Ledger has asked resellers and distributors across seven Asian markets to stop selling its hardware wallets and pull the devices from shelves while it investigates tamper incidents involving a hidden implant. The request, announced in a post on X on Tuesday, covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

The hardware wallet maker said confirmed incidents remain limited to Southeast Asia and that it has not verified a drain tied to a device purchased elsewhere. "To be clear, as the investigation continues, the only confirmed incidents remain contained to Southeast Asia. We have not verified a drain linked to a device bought elsewhere," the company said, adding that it is still working to "determine who tampered with these devices and where in the distribution chain it happened." All confirmed losses so far involve devices sold through reseller CryptoBilis, Ledger has previously said, and the wider request expands on an earlier call for CryptoBilis to halt sales and shipments after the probe went public on Oct. 9.

According to details from Ledger's Donjon security team, the implant reads a device's 24-word recovery phrase from the screen during setup and transmits it out over LTE, allowing whoever holds the phrase to restore the wallet and move its funds. Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger said it has not verified. "We have no indication that Ledger's infrastructure, systems or services or direct sales channel have been compromised," the company added.

Separately on Tuesday, MediaMarkt Saturn stopped selling Ledger devices in its stores and online, with Ledger's agreement, after a customer in Germany reported finding an implant, though no loss of funds was reported. Rival hardware wallet maker Trezor said on Tuesday it will end its authorizations for resellers on January 1, 2027, describing the move as a "precautionary measure" and noting there is no evidence its own devices have been compromised.