Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its hardware wallets and pull them from store shelves while it investigates devices fitted with a hidden implant, the company said in a post on X on Tuesday.

The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. Ledger said the only confirmed incidents remain in Southeast Asia and that it has not verified a drain linked to a device purchased elsewhere.

Ledger, a Paris-based hardware wallet maker, is one of the most widely used providers of devices that keep the private keys controlling cryptocurrency funds offline.

Incident Update - Oct 13th, 2026

Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices while the investigation is ongoing. This includes products off the shelves.

Specifically the countries are: Indonesia,…

— Ledger (@Ledger) October 13, 2026

The company has previously said that all confirmed losses involve devices sold through CryptoBilis, a reseller in the region. Ledger is still working to establish who tampered with the affected devices and at what point in the distribution chain the modification took place, and said it has no indication that its own infrastructure, systems, services, or direct sales channel have been compromised. It has said the sales suspension in all seven markets will remain in effect while that work continues.

What investigators found

Ledger's Donjon security team found that the implant reads the 24-word recovery phrase from the device's screen during setup and sends it out over LTE. Hardware wallets are designed to keep funds offline, and during setup a Ledger device generates a recovery phrase that can be used to restore the wallet on another device. However, anyone holding that phrase can restore the wallet and move its funds — which is why a phrase captured at the moment of setup hands an attacker everything needed to empty a wallet without ever handling the device again.

Onchain investigator Specter has traced more than $86 million in suspected thefts tied to the tampered devices, a figure Ledger says it has not verified.

Retailer and industry response

Earlier on Tuesday, electronics retailer MediaMarkt Saturn, one of Europe's largest consumer electronics retailers, stopped selling Ledger devices in its stores and online, with Ledger's agreement, after a customer in Germany reported an implant, Ledger said in a separate post on X. No loss of funds was reported in that case.

Rival hardware wallet maker Trezor, which also sells devices that store cryptocurrency keys offline, said on Tuesday that it will end its authorizations for resellers on January 1, 2027, describing the move as a "precautionary measure." Trezor said there was no evidence that its own devices had been compromised.

For the hardware wallet sector, both moves put the focus on the third-party retail channel between factory and customer. Trezor's reseller authorization changes take effect on January 1, 2027, the next fixed date in a case where the key question — where in the supply chain the tampering occurred — is still unanswered.