Ledger has asked distributors and resellers in six Southeast Asian countries and Hong Kong to stop selling its hardware wallets while it investigates devices allegedly fitted with a hidden implant. The company said confirmed incidents remain limited to Southeast Asia, although a German customer also reported an implanted device without losing funds.
Investigation focuses on tampered devices
The sales suspension covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. Ledger said resellers should remove the devices from store shelves while the investigation continues.
According to Decrypt, Ledger’s security team, Donjon, found that the implant can read a wallet’s 24-word recovery phrase from the device screen during setup and transmit it over LTE. The recovery phrase is the master backup used to restore a crypto wallet; anyone who obtains it may be able to access the wallet and move its assets.
Blockchain investigator Specter has linked more than $86 million in suspected thefts to the incident. Ledger said it has not independently verified that figure. The company has also said that all confirmed losses so far involve devices sold through CryptoBilis, a reseller in the region.
Ledger is still trying to determine who modified the devices and where in the distribution chain the tampering occurred. It said there is no indication that its own infrastructure, systems, services or direct-sales channel was compromised. The company also said it has not verified any funds drained from a Ledger device purchased outside the affected region.
German retailer pauses Ledger sales
MediaMarkt Saturn stopped selling Ledger products in its physical stores and online after a customer in Germany reported finding an implant. Ledger said the retailer took the step with its agreement. No funds were lost in that case.
The German report broadens the retail response, but Ledger continues to distinguish it from the confirmed financial incidents in Southeast Asia. The company has not reported a verified loss connected to the German device or to a purchase made elsewhere.
Trezor takes a precautionary step
Trezor, a rival hardware-wallet manufacturer, said it would end its authorizations for resellers on January 1, 2027. It described the decision as a precautionary measure and said there was no evidence that its own devices had been compromised.
Hardware wallets are physical devices designed to protect the credentials needed to authorize cryptocurrency transactions. The incident highlights why the recovery phrase is especially sensitive: possession of that phrase can allow a wallet to be restored on another device, regardless of where the original hardware wallet was bought.
Moneyiar market picture
Moneyiar data at 21:33–21:34 on October 15, 2026, showed mixed performance among the tracked digital assets:
- TRON (TRX): $0.332142763, down 0.16% over 24 hours and 0.16% over seven days.
- edgeX (EDGE): $0.3161489616, down 1.66% over 24 hours and 14.82% over seven days.
- Rain (RAIN): $0.0095575158, up 4.51% over 24 hours and down 7.26% over seven days.
- Ailey (ALE): $0.2675845958, up 0.09% over 24 hours and down 0.04% over seven days.
