Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to stop selling its hardware wallets and take them off shelves. The move widens a sales halt that began last week with a single reseller.
In an update posted on X on Tuesday evening, the Paris-based company named Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. “The investigation is ongoing to determine who tampered with these devices and where in the distribution chain it happened,” Ledger said. The request builds on Ledger’s Oct. 9 call for CryptoBilis, a reseller in the region, to pause all sales and shipments.
Earlier Tuesday, Ledger’s Donjon security team described how the tampering works. An added component sits inside the device’s case and reads the screen. When the wallet shows its 24-word recovery phrase during setup, the implant decodes the words and sends them out over a mobile network using a built-in eSIM. Ledger said the implant does not modify the Secure Element, the chip that guards private keys, or the device’s operating system, and does not alter transactions or signatures. The company said it has no indication that its own systems or its direct sales channel were compromised.
Ledger says the confirmed losses so far are confined to Southeast Asia. “We have not verified a drain linked to a device bought elsewhere,” it said. In replies to users on Wednesday, the company said confirmed losses involve devices sold “through a limited number of resellers,” without naming them.
Ledger has not confirmed a loss total or a victim count, and says figures circulating online come from third parties. Blockchain analytics firm Bitquery counts $102.0 million taken from 324 wallets across six blockchains, up from early estimates near $86 million. Bitquery says Tether froze $10.0 million in USDT and that about $84 million could still be traced on-chain as of Tuesday morning.
The worry has reached store shelves elsewhere. In Singapore, The Straits Times reported that a tampered device had been sold at Metapod in Changi Airport and that another was reportedly bought at a Challenger outlet. In Europe, MediaMarktSaturn has pulled Ledger products after a customer in Germany reported an implant. Ledger said no funds were lost in that case. Rival Trezor said Tuesday it is cutting its own reseller network as a precaution, adding that “there is not a single piece of evidence” its devices have been compromised.
Ledger’s advice has not changed. CryptoBilis buyers should not set up unused devices, and anyone already using one should move funds to a new device with a new recovery phrase. People who lost funds should contact law enforcement before opening the device.
Sources: Ledger; Bitquery; The Straits Times; Cointelegraph; The Block