Key Notes
- Ledger has asked resellers in six Southeast Asian countries and Hong Kong to suspend wallet sales and remove devices from shelves.
- The company says confirmed incidents remain in Southeast Asia, while thefts linked to devices bought elsewhere have not been verified.
- Investigators are tracing where devices were altered, with no indication of a compromise of Ledger’s systems or direct sales channel.
Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to stop selling its hardware wallets and remove devices from shelves while it investigates pre-sale tampering. The request broadens the response beyond CryptoBilis, the reseller at the center of the initial October theft investigation.
The company’s October 13 update names Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. Ledger says its confirmed incidents remain confined to Southeast Asia and that it has not verified a cryptocurrency drain linked to a device bought elsewhere.
Ledger asks resellers and distributors in Southeast Asia and Hong Kong to suspend device sales during its tampering investigation.
Investigators are still determining who altered the devices and where the modifications entered the distribution chain. Ledger says it has found no indication that its infrastructure, systems, services or direct sales channel have been compromised.
The sales-pause request now covers seven markets
The notice asks the regional retail and distribution network to suspend sales during the investigation, including taking products off shelves. It does not give a reopening date, identify affected serial-number ranges or provide a complete count of modified devices.
It also does not establish that every retailer has implemented the request or that every wallet sold in those markets contains an implant. The geographic scope describes the precaution Ledger is seeking, rather than a verified inventory of compromised products.
The earlier response focused on CryptoBilis. On October 10, Ledger confirmed an unauthorized hardware implant in one affected customer’s device and said the reseller had stopped selling all hardware-wallet inventory. Our company-confirmation report explains what that finding established.
Ledger subsequently said the confirmed cases associated with the draining incident disclosed on October 9 involved CryptoBilis devices. The new regional request extends precautions across a much larger distribution area without identifying where tampering occurred or attributing responsibility to a particular business.
European reports and confirmed thefts remain distinct
Ledger’s statement about unverified drains outside Southeast Asia needs to be read alongside the separate physical-device reports. A researcher finding added hardware, a buyer reporting a suspicious purchase and a company verifying a theft are different pieces of evidence.
CoinScreamer’s MediaMarkt coverage examined a buyer’s account of similar modifications in wallets bought from two European stores. The buyer said he recorded an unboxing and was submitting devices for examination. That account did not establish a theft from those units or compromise across the retailer’s entire inventory.
In Singapore, Mark Karpelès separately reported additional hardware inside a Ledger Flex bought at the airport. As our airport report explains, owner Ben Yorke said the device had never been plugged in. His account concerns an unused wallet submitted for inspection, with no reported loss from that device.
These reports raise questions about distribution and device provenance. They do not, by themselves, connect every purchase to one operation or demonstrate that a named retailer knowingly handled altered stock. Ledger’s regional notice leaves those attribution questions open.
Why a genuine chip cannot rule out an implant
The technical concern is that a genuine wallet can acquire malicious components around its original security hardware. Ledger Donjon’s documentation explains that Genuine Check authenticates the secure element but cannot detect unauthorized physical modifications when that original chip remains intact.
Separate Nano X research by Joe Grand and Tibane Labs describes implants that intercept data traveling to the display, reconstruct recovery words and transmit them through cellular components. The attack examines information the device must show during setup, rather than demonstrating a break of the secure element’s cryptography.
Tibane’s technical report concerns specimens obtained through Japanese marketplaces. Neither was purchased from CryptoBilis, and the lab has not established a connection to that reseller. Ledger has not published a forensic comparison tying every reported October device to those designs.
Our warning timeline traces the earlier research and Ledger’s awareness of similar implants. It documents a known attack method while keeping separate the question of which later customers and retail inventories were affected.
Ledger directs concerned owners to official support
Ledger says its Donjon security team will analyze devices it receives and that customer support will provide guidance through its official channel. The October 13 notice does not publish a new universal migration instruction for every owner in the seven markets.
The company’s earlier CryptoBilis guidance remains more specific: do not initialize unused devices bought from that reseller; if already set up, move to a new seed on a device obtained from Ledger. That instruction should retain its stated scope.
Replacing hardware and replacing an exposed recovery phrase are separate steps. Ledger’s security guidance explains that restoring a phrase recreates access to the same wallet. Anyone who already knows those words retains that access; a new phrase creates different keys.
Recovery words should never be shared with support staff or entered into a website offering an investigation. For now, the unresolved issue is the physical chain of custody: how particular devices were modified, how they reached buyers and which theft transactions can be tied to examined hardware.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
