Ledger Freezes Wallet Sales Across Southeast Asia and Hong Kong Over Spy Implants

Shopping for a crypto hardware wallet in the Philippines just got harder. The Paris-based wallet maker has asked its resellers and distributors in the Philippines, Indonesia, Singapore, Thailand, Vietnam, Malaysia and Hong Kong to stop selling its devices and pull them from shelves while it investigates wallets that were tampered with to steal their owners' crypto.

Ledger announced the regional freeze in an update on X on October 13. "To be clear, as the investigation continues, the only confirmed incidents remain contained to Southeast Asia. We have not verified a drain linked to a device bought elsewhere," the company said, as reported by Cointelegraph. It added that it is still working out who tampered with the devices and where in the distribution chain it happened, and that it has no indication its own infrastructure, systems, services or direct sales channel were compromised.

The trouble surfaced on October 9, when owners reported stolen funds tied to devices bought through CryptoBilis, a Malaysia-based reseller that sells across the region. Ledger asked CryptoBilis to halt sales and shipments that day, and a day later confirmed to BleepingComputer that one affected user's device contained "an unauthorized hardware implant." Ledger has since said that all confirmed reports of unexpected drains trace back to devices sold through CryptoBilis.

How the implant works is the unsettling part. According to Decrypt, Ledger's Donjon security team found that it reads the 24-word recovery phrase off the device's screen during setup and sends it out over a mobile LTE connection. Anyone holding that phrase can restore the wallet elsewhere and empty it. BleepingComputer also notes that Ledger's Genuine Check, the built-in authenticity test, cannot detect an added implant when the original secure element is left intact.

Onchain investigator Specter has traced more than US$86 million in suspected thefts, a figure Ledger says it has not verified, and the company told The Straits Times it cannot yet confirm how many people were hit. In Singapore, one tampered device was found to have been sold at a Metapod outlet in Changi Airport.

The worry is no longer just regional. European electronics chain MediaMarktSaturn has stopped selling Ledger products in its stores and online after a customer in Germany reported finding an implant, though no loss of funds was reported. Rival Trezor said it will end its reseller authorizations on January 1, 2027 as a precaution, while stressing there is no evidence its own devices were affected.

For people who already own a hardware wallet, Ledger's advice, per BleepingComputer, is to avoid unauthorized resellers, which carry a higher risk of counterfeit or modified devices. It has also reminded its authorized resellers and distributors to source products only through official channels and not to restock returned units. If you bought a Ledger through an unofficial channel in Southeast Asia recently, it is worth following the company's incident updates closely until the investigation wraps up.