Ledger Pulls Wallets From Seven Asian Markets as Tampering Probe Widens
By Coinvote
Ledger has asked resellers in six Southeast Asian countries and Hong Kong to stop selling its hardware wallets while it investigates tampered devices. Analytics firms trace up to $93.2 million in stolen crypto to units sold by one reseller.
Ledger widens its sales freeze beyond a single reseller
Cointelegraph reported that Ledger told sellers and distributors across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to pause sales and pull its hardware wallets from retail display. The company made the request in a post on X on Tuesday while its investigation into tampered devices continues.
The Defiant's headline and summary carry the same message in shorter form. Ledger says confirmed incidents remain confined to Southeast Asia, and it sees no sign that its own systems or direct sales channel were compromised.
From one reseller to a regional request
The wider request builds on an earlier instruction for the reseller CryptoBilis to stop sales and shipments. Cointelegraph says the matter first surfaced publicly on Oct. 9, when users reported thefts of crypto connected to hardware purchased from that reseller.
Since then, users elsewhere have come forward. Cointelegraph said users in Europe and other areas have since reported signs that devices they bought from retailers may have been tampered with. Ledger's stated position is that it has confirmed no theft tied to a device purchased outside Southeast Asia.
Cointelegraph also linked to a separate report that Trezor has reduced its resellers as a preventative step. Neither outlet says that move is tied to the Ledger losses itself, so it is best read as a sign that the wider hardware-wallet industry is watching the case.
What the loss estimates show
CoinDesk reported that several blockchain analytics and intelligence firms put the amount siphoned from wallets linked to CryptoBilis devices at up to $93.2 million. Those figures come from public blockchain data and are not a confirmed loss total from Ledger.
- Bitquery traced $93.2 million, mostly in USDT and TRON tokens, taken from 315 wallets across six blockchains.
- YFarmX reported a higher figure of $94.5 million, drawn from 521 addresses across seven blockchains.
- Tether has frozen $10 million in USDT tied to the theft, and Bitquery confirmed the freeze.
- As of Oct. 11, Bitquery estimated that about $81 million remained traceable onchain, and it noted that part of the money had passed through Tornado Cash and Zcash.
How the outlets' accounts line up
The three outlets agree on the core message from Ledger: confirmed cases are limited to Southeast Asia, and the company's infrastructure and direct channel are not implicated. They differ in what they add. Cointelegraph supplies the list of affected markets and the first signs of tampering reports from Europe. CoinDesk supplies the loss estimates, the freeze and the criticism of Ledger's framing.
There are also differences in the numbers. Bitquery and YFarmX disagree on the wallet count, the address count and the number of chains involved. CoinDesk presents both as estimates, and neither is a figure Ledger has endorsed.
According to CoinDesk, Ledger acknowledged that at least one affected device contained an unauthorized hardware implant. CoinDesk added that the company gave no indication of whether the stolen wallet was affected by that implant or of the method used to tamper with the devices. Ledger told Cointelegraph that its inquiry is still trying to identify who interfered with the devices and at which point in the supply chain this took place.
Why the authorized-reseller label matters
CoinDesk reported that Ledger's effort to frame the episode as a CryptoBilis problem has drawn pushback, since Ledger's own website named the reseller as an authorized seller. One X user, MyCryptoParadise, wrote: "It's not a CryptoBilis incident, it's a Ledger incident."
For hardware wallets, the supply chain is part of the security model. A device that arrives pre-tampered can defeat the protection a user expects, even if the manufacturer's firmware and services are untouched. That is why the debate centres on who vouches for a sales channel, not only on who made the device.
CoinDesk also distinguished this case from a phishing campaign in April that used a counterfeit Ledger Live app on Apple's App Store and took at least $9.5 million once users typed in their recovery phrases. In the present case, CoinDesk wrote, the attacker seems to have gained access to the keys required to drain hundreds of wallets directly.
Practical steps for holders and project teams
According to CoinDesk, Ledger told CryptoBilis customers to leave unused devices unconfigured. Customers who have already put a device to use were told to transfer their funds to a fresh device set up with a newly created recovery phrase.
The Tether freeze shows one reason stablecoin exposure is treated differently in theft cases. CoinDesk noted that, unlike bitcoin or ether, stablecoins can be blocked by their issuers when the tokens are tied to criminal activity. Teams holding treasury funds on hardware wallets may want to review where their devices were bought and whether they were sold through an intermediary.
Open questions to watch
Ledger has not said where in the distribution chain the tampering occurred. It also did not immediately respond to CoinDesk about the total stolen or about any reimbursement plan for affected users. Tether did not immediately respond to a request for comment on the freeze.
Another open point is whether the reports from Europe are confirmed to involve the same method. Ledger says no theft has been confirmed for a device obtained outside the region, and the sources do not establish a connection between those reports and the Southeast Asian thefts.
Market snapshot
| Asset | Price | 24h | 7d | Market cap |
|---|---|---|---|---|
| Bitcoin (BTC) | $83,359 | +0.3% | -0.5% | $1.68 trillion |
| Ethereum (ETH) | $2,503 | +0.6% | -3.5% | $305.62 billion |
CoinGecko data as of 2026-10-14 (UTC).
FAQ
Which markets has Ledger asked resellers to stop selling in?
Ledger told resellers across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to pause sales and pull its hardware wallets from retail display. Cointelegraph reported the request, which Ledger made in a post on X on Tuesday.
How much crypto was stolen in the Ledger CryptoBilis case?
Analytics firms estimate up to $93.2 million. Bitquery traced $93.2 million, while YFarmX reported $94.5 million. Both figures come from public blockchain data and are not a confirmed Ledger loss total, CoinDesk reported.
What should CryptoBilis customers do with their Ledger devices?
Ledger told them to leave unused devices unconfigured. Anyone who has already used a device was told to transfer funds to a fresh device set up with a newly created recovery phrase.
Sources
- Cointelegraph: Ledger asks resellers to halt sales in Southeast Asia and Hong Kong (2026-10-13)
- The Defiant: Ledger Asks Resellers to Halt Sales in Seven Asian Markets (2026-10-13)
- CoinDesk: Ledger claims CryptoBilis cases are limited as up to $93 million is traced, $10 million frozen (2026-10-12)
- CoinGecko (market data)
Written by the Coinvote news desk from reporting by Cointelegraph, The Defiant and CoinDesk. Not financial advice.
