Ledger has instructed resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its hardware wallets while it investigates devices fitted with hidden implants. The request, issued on October 13, 2026, covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. Ledger stated that confirmed incidents remain limited to this region and that no verified fund drains have been linked to devices purchased elsewhere. All confirmed losses involve devices sold through CryptoBilis, a regional reseller.
The company’s Donjon security team identified that the implant reads the 24-word recovery phrase from the device screen during setup and transmits it via LTE, allowing attackers to restore wallets and move funds. Onchain investigator Specter traced more than $86 million in suspected thefts, though Ledger noted it has not independently verified this figure. Ledger emphasized there is no indication that its own infrastructure, systems, services, or direct sales channels were compromised, and it continues to determine who tampered with the devices and where in the distribution chain the breach occurred.
Separately, MediaMarkt Saturn halted sales of Ledger devices in Germany, both in stores and online, after a customer reported an implant. No funds were lost in that incident. Rival manufacturer Trezor announced it will end authorizations for all resellers by January 1, 2027, as a precautionary measure, stating there was no evidence its devices had been compromised.
This development highlights a critical vulnerability in the physical supply chain of cryptocurrency hardware wallets, distinct from software or network-level attacks. By suspending sales in specific regions, Ledger acknowledges that the compromise occurred at the distributor or retail level rather than within its manufacturing or digital infrastructure. The use of LTE-enabled implants to exfiltrate recovery phrases during initial setup represents a sophisticated, targeted attack vector that bypasses traditional cybersecurity measures focused on digital transmission.
The broader market implication is a potential erosion of consumer trust in third-party distribution channels for high-value security assets. While Ledger claims its direct channels are secure, the inability to verify the $86 million loss figure underscores the opacity often found in crypto-related theft investigations. Competitors like Trezor moving to eliminate reseller authorizations suggests an industry-wide reassessment of how hardware security products reach end-users, potentially shifting toward direct-to-consumer models to mitigate similar risks.
