Ledger Pauses Device Sales in Seven Asian Markets as Implant Investigation Continues

Ledger has asked resellers in seven Asian markets, including Hong Kong, to stop selling its hardware wallets while it investigates an LTE implant that captured recovery phrases. Onchain investigator Specter puts suspected thefts above $86 million, an amount Ledger says it has not checked.

Ledger extends its sales halt to seven markets

According to Decrypt, Ledger has requested that retailers and distributors across Southeast Asia and in Hong Kong suspend sales of its hardware wallets and pull stock from shelves. The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

Protos reported that the step builds on the earlier suspension of CryptoBilis, the Malaysian reseller tied to the losses. Protos listed marketplaces and exchanges among the affected sellers, including Shopee, Tokopedia, Bitkub and HKTVMALL, and noted that it remains to be seen whether every one of them complies.

In Europe, the retailer MediaMarkt Saturn ended sales of Ledger products, both in shops and on its website, with the manufacturer's consent, after a German customer reported discovering an implant. Decrypt said no loss of funds was reported in that case.

How the implant steals a recovery phrase

Ledger's Donjon security team found that the implant sits inside the device enclosure and reads what appears on the screen, as Decrypt reported. When it detects the recovery phrase screens, a microcontroller decodes the 24 words and sends them out over LTE using a provisioned eSIM.

Ledger said the implant is a separate component. It does not alter the Secure Element or the Ledger operating system, and it does not change transactions or signatures. The practical effect is that the attacker never has to break the chip. The words are copied at the moment they are displayed, and whoever holds them can rebuild the wallet elsewhere.

Timeline and key figures

The incident has moved quickly over about a week, based on the accounts of Bitcoin Magazine and Decrypt.

• Friday: Ledger disclosed that customers in Southeast Asia had reported lost funds after buying from a reseller and said it had opened an investigation.
• Saturday: Ledger confirmed an unauthorized hardware implant in one affected user's device.
• Sunday: Ledger said it was working with authorities and that CryptoBilis had stopped selling its wallets.
• Tuesday: Ledger asked resellers in seven markets to suspend sales, and MediaMarkt Saturn halted sales.
• More than $86 million: the amount of suspected thefts traced by onchain investigator Specter across Ethereum, Tron and Bitcoin, which Ledger says it has not verified.

Where the outlets' accounts differ

The reports agree on the core facts but vary in how firmly they state the loss. Protos describes the devices as spyware-laden and links them directly to an $86 million hack. Decrypt attributes the figure to Specter and stresses that Ledger has confirmed neither the number of affected users nor the value lost.

Bitcoin Magazine captured an earlier stage of the story. Bitcoin Magazine reported that Ledger described the affected products as few in number, but the number containing implants remained unknown. According to Decrypt's subsequent report, Ledger is investigating additional reports of modified devices beyond the initial cases. These include an X user's allegation that two devices purchased at European shops contained implants, which has not been independently verified.

Protos also covers a dispute involving Trezor, which the other outlets only touch on. Some tampered Trezor wallets were reportedly bought from unauthorized sellers on Facebook Marketplace and TikTok Shop. Trezor says these resemble a case flagged in 2022 in which unofficial sellers swapped out the microcontroller itself instead of installing an extra component in an authentic device.

Trezor pulls back and earlier wallet incidents resurface

Trezor said it will end its reseller authorizations on January 1, 2027, calling the move a "precautionary measure" and saying it has no evidence its devices were compromised. Protos reported that Trezor did not say which resellers are affected and that it had also stopped working with CryptoBilis.

Bitcoin Magazine placed the episode within a difficult year for hardware wallet security. It cited a July incident in which hackers stole close to $120 million in bitcoin from Coldcard users because of a firmware bug in seed generation, and a leak of details of close to 81,000 Trezor customers through a fulfillment partner. These are different failure modes from a physical implant, but they show how many points in a wallet's supply chain can be targeted.

What holders can check now

Ledger advised CryptoBilis customers whose device is still unconfigured to leave it that way and get in touch with support. Customers who already set theirs up should quickly transfer their funds to a fresh device with a newly generated recovery phrase, and should never enter or restore a phrase on a CryptoBilis device.

Anyone who lost funds or holds a tampered device should report it to local law enforcement and avoid opening the device or sending it to anyone before speaking to Ledger Support or the police. Buyers from other sellers can inspect the inside of a device using a Ledger guide, though Ledger cautioned that opening the casing risks damaging the device and advised backing up the phrase beforehand. The company also repeated that it will never call or message users to ask for a recovery phrase.

Open questions to watch

According to Decrypt, Ledger's investigation is seeking to identify those responsible for installing the implants and determine where the modifications occurred along the distribution chain. Ledger said nothing points to a compromise of its own infrastructure, services or direct sales channel, and it has not verified any drain tied to a device purchased outside the region.

Several points remain unresolved. Ledger has not confirmed how many devices carry the implant or what total was lost, and the European retail claims are unverified. It also remains unclear how widely resellers will follow the sales halt and whether other wallet makers will narrow their own distribution networks. Ledger told Protos it will share more once there is more to report.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$81,991	-1.8%	-1.7%	$1.65 trillion
Ethereum (ETH)	$2,442	-2.9%	-5.7%	$298.17 billion
TRON (TRX)	$0.333401	+2.0%	-0.3%	$31.67 billion

CoinGecko data as of 2026-10-14 (UTC).

FAQ

What did the Ledger implant actually do?

According to Ledger's Donjon team, a hidden component inside the device read the 24-word recovery phrase from the screen during setup. It then sent the words out over LTE through an eSIM. Ledger said the Secure Element and operating system were left untouched.

Which Ledger devices are affected?

Ledger says every confirmed loss traces back to wallets that CryptoBilis, a Southeast Asian reseller, sold. It has not confirmed any theft connected to a device purchased from another seller. It is also examining reports that implants may exist in other devices and in other places.

How much money was stolen?

Specter, an onchain investigator, tallied suspected thefts of over $86 million spread over the Ethereum, Tron and Bitcoin networks. Ledger says it has not verified that figure and has not confirmed the number of affected users.

Sources

• Decrypt: Ledger Asks Resellers in Seven Asian Markets to Pull Devices After Suspected $86M Drain (2026-10-14)
• Protos: Ledger asks more Southeast Asia resellers to halt wallet sales (2026-10-14)
• Bitcoin Magazine: Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device (2026-10-12)
• Decrypt: Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain (2026-10-13)
• CoinGecko (market data)