Ledger has asked authorized resellers and distributors in Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong to stop selling its hardware wallets and remove them from store shelves. The move follows reports of cryptocurrency theft involving devices sold by Southeast Asian reseller CryptoBilis and an investigation into where the tampering occurred in the distribution chain.
The incident surfaced on Oct. 9 after users reported losses linked to Ledger devices bought through CryptoBilis, which had been listed as an authorized reseller in Indonesia, Malaysia and the Philippines.
Ledger’s security team confirmed that at least one affected device contained an unauthorized implant. The component could read the 24-word recovery phrase displayed during setup and transmit it over an LTE connection using an embedded SIM. Ledger said the implant did not alter the device’s security chip, operating system, transactions or signatures, and that the company had no indication its infrastructure, services or direct-sales channel had been compromised.
Blockchain investigators have estimated losses above $86 million, while other estimates have been higher, but Ledger has not verified the total amount stolen or the number of affected users. The company has said confirmed losses remain tied to Southeast Asia and has not verified a drained wallet connected to a device bought elsewhere.
Reports of suspected tampering have also emerged outside the region. A customer in Germany reported an implanted device, prompting European retailer MediaMarktSaturn to suspend Ledger sales across its markets, although no financial loss was reported in that case. Ledger has not confirmed that the European report is connected to the CryptoBilis investigation.
Trezor removed CryptoBilis from its authorized reseller network despite reporting no evidence that its devices were compromised. OneKey also ended the reseller relationship, said it had found no related customer losses and offered replacement devices for qualifying CryptoBilis purchases. Ledger is directing concerned customers to its support team and inspection guidance while investigators examine recovered hardware and determine how the implants entered the supply chain.