Ledger Halts Hardware Wallet Sales Across Seven Asian Markets After Suspected $86 Million Crypto Theft

Cryptocy hardware wallet manufacturer Ledger has ordered resellers and distributors across seven Asian markets to suspend sales after investigators discovered devices containing hidden electronic implants capable of stealing users’ wallet recovery phrases. The investigation follows reports of more than $86 million in suspected cryptocy thefts involving Bitcoin, Ethereum and Tron. Ledger has confirmed that some devices were physically tampered with but has not independently verified the total financial losses or number of affected customers.

Ledger Pulls Hardware Wallets From Seven Asian Markets

Ledger, the French company known for its cryptocy hardware wallets, announced on October 13 that distributors and resellers in Southeast Asia and Hong Kong must temporarily remove its devices from sale.

The suspension covers seven markets:

• Indonesia, Singapore and Thailand

• The Philippines and Vietnam

• Malaysia and Hong Kong

The company is investigating how unauthorized hardware modifications entered its distribution network.

Ledger said all confirmed incidents involving stolen funds remain connected to devices sold through CryptoBilis, a reseller operating in Southeast Asia.

However, the company has not determined exactly who modified the devices or when the tampering occurred.

Hidden Chips Steal 24-Word Crypto Recovery Phrases

Ledger’s internal security research team, Donjon, discovered an unauthorized electronic implant inside an affected hardware wallet.

The implant was designed to capture the 24-word recovery phrase displayed on the device’s screen during its initial setup.

The recovery phrase is the master backup that allows someone to restore a cryptocy wallet and control its assets.

According to Ledger’s investigation, the malicious hardware operates through several components:

• Hidden microcontroller: Reads information displayed on the wallet’s screen.

• LTE cellular connection: Transmits stolen information to attackers.

• Embedded eSIM: Allows the implant to communicate without using the owner’s computer or Wi-Fi connection.

Once attackers obtain a wallet’s recovery phrase, they can potentially restore that wallet elsewhere and transfer its cryptocy without the owner’s authorization.

Importantly, Ledger said the implant does not need to modify the device’s Secure Element, operating system or transaction-signing software.

Instead, the attack targets the recovery phrase before the owner has an opportunity to secure their funds.

Investigators Trace More Than $86 Million in Suspected Losses

Blockchain investigator Specter has traced more than $86 million in suspected cryptocy thefts associated with the incident.

The investigation reportedly involves transactions across multiple blockchain networks, including Bitcoin, Ethereum and Tron.

However, Ledger has emphasized that these figures are third-party estimates.

Several important details remain unconfirmed:

• The exact amount of cryptocy stolen

• The total number of affected customers

• How many compromised devices entered circulation

• Who manufactured or installed the implants

• Where in the distribution process the tampering occurred

The company has confirmed the presence of an unauthorized implant in at least one affected device but has not independently verified the full scope of the suspected thefts.

German Retailer MediaMarkt Also Suspends Ledger Sales

The investigation has expanded beyond Southeast Asia.

European electronics retailer MediaMarkt Saturn suspended Ledger hardware wallet sales in its physical stores and online after a customer in Germany reported discovering a suspicious implant.

Ledger agreed to the sales suspension while the device was investigated.

The company said no cryptocy losses were reported in the German incident.

Ledger also stated that it has not verified any fund-draining incident involving a device purchased outside Southeast Asia.

The German discovery nevertheless raises additional questions about the security of hardware wallets moving through third-party retail distribution channels.

Ledger Says Its Internal Systems Were Not Compromised

Ledger has emphasized that the incident appears to involve physical tampering within the supply chain, rather than a breach of its internal technology.

The company reported no evidence that its:

• Internal infrastructure or computer systems

• Ledger operating system or Secure Element technology

• Official direct-sales channel

had been compromised.

That distinction is significant because hardware wallets are designed to protect cryptocy private keys from remote attacks.

In this case, the attackers allegedly bypassed those protections by modifying the physical device before it reached the customer.

The investigation highlights a different security risk: even a legitimate hardware wallet can become dangerous if malicious components are installed before its initial setup.

Ledger Warns Customers to Protect Their Cryptocy

Ledger has issued specific guidance to customers who purchased devices from CryptoBilis.

Customers who have not activated their devices should avoid setting them up and contact Ledger Support.

Customers who already initialized a potentially affected wallet should consider transferring their cryptocy to a new, trusted device using a completely new recovery phrase.

Additional precautions include:

• Never enter a recovery phrase into an unfamiliar website or application.

• Avoid restoring a potentially compromised recovery phrase on another device.

• Verify support instructions through Ledger’s official website.

• Contact Ledger Support before attempting to open or physically inspect a suspicious device.

Ledger has also warned that scammers may exploit the incident by impersonating customer support representatives.

The company says it will never ask users to disclose their recovery phrases.

Trezor Tightens Reseller Policies Following Ledger Investigation

The security concerns are also affecting competing hardware wallet manufacturers.

Trezor, another major cryptocy hardware wallet provider, announced that it plans to discontinue authorized reseller arrangements beginning January 1, 2027, as a precautionary measure.

Trezor emphasized that it has no evidence its own devices were compromised.

The decision reflects growing concerns about the security risks associated with distributing cryptocy storage devices through third-party retailers.

Hardware Wallet Security Faces a Major Supply Chain Test

Hardware wallets are widely considered one of the more secure methods for storing cryptocy because private keys are designed to remain isolated from internet-connected devices.

However, the Ledger investigation demonstrates that hardware security depends on more than encryption and software protections.

It also depends on ensuring devices have not been physically altered before reaching customers.

The suspected thefts could encourage manufacturers to introduce stronger anti-tampering protections, more restrictive reseller programs and additional device authenticity checks.