|
Getting your Trinity Audio player ready...
|
Ledger has asked resellers and distributors across seven Asian markets to stop selling its hardware wallets and take existing stock off shelves, as an investigation into tampered devices grows. The affected markets are Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. Independent investigators estimate losses of up to $93.4 million, though Ledger hasn’t confirmed that figure or how many customers were hit.
What happened
The probe went public on October 9, after users reported losing crypto from Ledger devices bought through the reseller CryptoBilis. On October 10, Ledger confirmed that one affected unit contained an unauthorized hardware implant.
According to Ledger’s technical explanation, the component could capture the 24-word recovery phrase shown on screen during initial setup and send it to attackers over a cellular link, using LTE and an embedded eSIM. A recovery phrase is the master key to a wallet. Whoever holds it can rebuild the wallet on another device and move the funds without touching the original hardware.
Why the design wasn’t the problem
Ledger says the implant didn’t alter the device’s Secure Element or operating system, and didn’t tamper with transactions or signatures. The attack instead exploited the physical device and the path it took to the customer. That’s the worrying part. The wallet’s software protections can stay intact while something added inside the case watches what happens at setup. A buyer usually can’t tell by looking at the packaging.
Reports beyond Southeast Asia
Other regions have since reported suspected cases, though none has been tied to the same attack. On October 13, German electronics retailer MediaMarktSaturn suspended Ledger sales in its stores and online after a customer in Germany reported finding an unauthorized implant. Ledger said no fund losses were reported in that case.
Former Mt. Gox chief Mark Karpeles also reported a suspected implant in a Ledger Flex bought at Singapore’s airport, with an antenna marked as a Eurasian version. That claim doesn’t show the device is linked to the CryptoBilis thefts. Ledger maintains that its confirmed losses remain confined to Southeast Asia and that it hasn’t verified a drain involving a device bought elsewhere.
The industry reacts
Competitor Trezor says it will shrink its reseller network, with some partnership changes taking effect on January 1, 2027. It says it has no evidence its own devices were compromised. The episode puts pressure on every hardware wallet maker to tighten reseller oversight, inspect stock and take responsibility for the supply chain.
What owners should do
Ledger advises customers who bought through CryptoBilis in the past 90 days not to set up any unused device. Those who already did should move their assets to a new device with a freshly generated recovery phrase. Anyone who suspects tampering should contact Ledger Support through its official website, and victims of theft should consider a police report and keep evidence.
Ledger also warns that scammers are exploiting the news with fake support calls, bogus recovery services and phishing messages. It says it will never call, message directly or ask for a recovery phrase. Nobody should give the phrase to support staff, type it into a website or send it over a chat app.
What remains unanswered
The investigation still has to establish how the implants entered the supply chain, who modified the devices, how many customers were affected and whether more devices outside the confirmed cases were altered. Until then, the focus stays on reseller oversight and the physical integrity of the devices that guard people’s crypto.
Disclaimer: The information in this article is for general purposes only and does not constitute financial advice. The author’s views are personal and may not reflect the views of Chain Affairs. Before making any investment decisions, you should always conduct your own research. Chain Affairs is not responsible for any financial losses.
