Ledger, the Paris-based maker of cryptocurrency hardware wallets, has asked resellers and distributors in six Southeast Asian countries and Hong Kong to stop selling its devices. The company is investigating reports that some of its wallets were tampered with before reaching customers.

The request covers sellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam and Malaysia, as well as Hong Kong. Ledger asked them to suspend sales and remove the devices from store shelves while the investigation continues, in a pause that spans seven markets in total. The company shared the update in a post on X on Tuesday.

The move follows reports of stolen cryptocurrency tied to devices bought through CryptoBilis, one of Ledger's third-party resellers.

Incident Update – Oct 13th, 2026

Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices while the investigation is ongoing. This includes taking products off the shelves.

Specifically the countries are: Indonesia,…

— Ledger (@Ledger) October 13, 2026

Source: @Ledger on X

Ledger said in the post that the suspension applies while the investigation is ongoing, and the message begins to name the affected countries, starting with Indonesia.

Where the Investigation Stands

Ledger said the confirmed cases remain limited to a single region. "To be clear, as the investigation continues, the only confirmed incidents remain contained to Southeast Asia," the company said.

It added that it has not verified any loss of funds tied to a device bought in any other market. "We have not verified a drain linked to a device bought elsewhere," Ledger said.

The company is still working to find out who altered the devices and to determine at which point in the distribution chain the tampering took place. "The investigation is ongoing to determine who tampered with these devices and where in the distribution chain it happened," Ledger said.

How the Case Began

The sweeping pause across seven markets builds on a narrower step the company took earlier. Before Tuesday's announcement, Ledger had already asked CryptoBilis, a reseller of its products, to stop sales and shipments of its devices. The investigation became public on Oct. 9, following reports of stolen cryptocurrency linked to Ledger devices bought through the reseller.

A hardware wallet is a small physical device that stores the private keys used to access cryptocurrency. Users rely on it to keep their funds offline and away from online threats. Private keys are the cryptographic credentials that control access to funds recorded on a blockchain, and anyone who obtains them can move the assets they protect.

If a device is altered before it reaches the buyer, an attacker may be able to access the funds stored on it. That is why reports of tampering draw close attention from users. It also puts the focus on a risk category distinct from exchange hacks or phishing: when a wallet is modified somewhere between the factory and the store shelf, the integrity of the physical distribution chain itself becomes the central security question.

The company makes devices for storing cryptocurrency and sells them through its own website and through third-party resellers around the world.

Reports From Other Regions

Since the first reports emerged in Southeast Asia, users in other regions have also come forward with concerns. Some in Europe said they found signs of suspected tampering in devices bought from retailers.

Ledger has not confirmed any of those cases, and the company has said its verified incidents remain tied to Southeast Asia.

No Sign of a Breach at Ledger

Ledger also addressed concerns about its own operations. The company said there is no sign that its core systems were affected.

"We have no indication that Ledger's infrastructure, systems or services or direct sales channel have been compromised," the company said.

The sales pause in Southeast Asia and Hong Kong remains in place while the investigation continues. Ledger has not said when sales could resume, leaving the key questions open for now: who altered the devices, at which point in the distribution chain it happened, and whether the unconfirmed reports from outside the region are verified or ruled out.