Ledger has asked resellers and distributors across six Southeast Asian countries and Hong Kong to stop selling its hardware wallets and remove existing inventory from shelves as the company investigates how physically modified devices entered the retail supply chain.The suspension covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, expanding an investigation that initially centered on CryptoBilis, a Southeast Asian reseller linked to reports of cryptocurrency being drained from customers’ wallets.

Ledger said every confirmed loss identified so far remains connected to devices sold in Southeast Asia and that it has not verified a wallet drain involving a device purchased elsewhere.

“The investigation is ongoing to determine who tampered with these devices and where in the distribution chain it happened,” Ledger said.

Why Did Ledger Expand the Sales Suspension?

The investigation became public on October 9 after Ledger asked CryptoBilis to suspend sales and shipments while it examined reports of missing funds. Ledger initially said the incident appeared isolated to the reseller and that its own infrastructure, systems and services had not been compromised.

The case changed materially after Ledger’s Donjon security team examined an affected device and found an unauthorized hardware implant.

The added electronics could monitor the 24-word recovery phrase as it appeared on the device display during initialization, reconstruct the words and transmit them through an LTE cellular connection using an embedded SIM. The implant did not need to compromise Ledger’s Secure Element, operating system or transaction-signing process.

That distinction turns the case from a conventional software breach into a physical supply-chain attack. Whoever obtained the recovery phrase could recreate the wallet elsewhere and move the assets without needing continued access to the modified device.

Investor Takeaway

The central risk has shifted from one reseller to whether Ledger can prove the integrity of devices throughout its wider distribution network.

Can Ledger’s Genuine Check Detect the Implant?

Not necessarily. Ledger’s own security documentation says its Genuine Check authenticates the Secure Element inside the device but cannot detect unauthorized physical modifications such as spying implants when the original Secure Element remains intact.

That limitation matters because the confirmed attack appears specifically designed to leave Ledger’s core cryptographic hardware untouched.

A wallet could therefore contain a genuine Secure Element and still have additional hardware elsewhere in the device capable of capturing sensitive information. Ledger has advised CryptoBilis customers who already initialized affected devices to move assets using a completely new recovery phrase rather than simply transferring the existing seed to another signer.

The company has not confirmed the overall value stolen or the number of customers affected. Independent blockchain researchers have published estimates exceeding $86 million, but Ledger has said those figures remain unverified.

Why Are European Retailers Pulling Ledger Devices?

The investigation is also attracting scrutiny outside Southeast Asia after customers reported suspected physical modifications in Ledger wallets purchased through European retailers.

MediaMarktSaturn removed Ledger products from its stores and online platforms across its international retail network on October 13 after a customer in Germany reported finding an unauthorized implant. The retailer described the withdrawal as precautionary.

Ledger has not verified a fund drain connected to the German device and has not established that the European reports are part of the same supply chain as the CryptoBilis cases.

A separate report also came from former Mt. Gox CEO Mark Karpelès, who said a Ledger Flex purchased at Singapore airport contained an implant. Ledger has not publicly confirmed that device as part of the incident.

Investor Takeaway

A confirmed case outside the original reseller network would materially increase the scope of Ledger’s supply-chain problem.

What Does Ledger Need to Establish Next?

The main unresolved question is where the devices were altered. Investigators need to determine whether tampering occurred at a distributor, reseller, logistics provider, through returned inventory or at another point between manufacturing and the final customer.

Ledger maintains that it has found no evidence its own infrastructure, services or direct sales channel were compromised. That distinction remains important: the current evidence points to physical devices being modified after manufacture rather than attackers penetrating Ledger’s internal systems.

But the broader suspension across seven Asian markets raises the standard Ledger now has to meet. The company must identify the point of compromise, determine how many devices may have passed through the affected distribution chain and establish whether the reports emerging elsewhere represent isolated cases or evidence of a wider operation.

Until that provenance work is complete, the incident leaves hardware-wallet security dependent not only on cryptography and secure chips, but also on something harder for users to verify themselves: the physical custody of the device before it reaches their hands.