Ledger Widens Reseller Halt Across Southeast Asia and Hong Kong

Ledger has asked sellers and distributors across six Southeast Asian countries and Hong Kong to suspend sales and take its hardware wallets off shelves while it investigates reports of tampered devices. In a post on X on Tuesday, Ledger said the request covers resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

The move widens a halt Ledger had already asked of CryptoBilis, a reseller it lists in Indonesia. CryptoBilis said in a notice on its website that it has paused all sales and shipments of Ledger devices while Ledger investigates.

If you bought a Ledger through CryptoBilis in the last 90 days, the guidance is specific. Ledger says not to start setting the device up, and if you already did, to consider moving your assets to a new Ledger signer with a new seed. That advice appears on Ledger's support page for the incident.

One gap is worth knowing before you read the rest. Ledger's own support page names CryptoBilis and the CryptoBilis pause, and does not mention the six countries plus Hong Kong. That wider halt rests on the company's post on X, which could not be read directly, so the list of markets comes from the company's statement as carried elsewhere.

What Ledger Says Was Done to the Devices

Ledger said Tuesday that devices sold through CryptoBilis contained hidden hardware implants that captured users' recovery phrases, which let attackers steal funds. Its security team found the implants read data shown on the screen, detected the 24-word recovery phrase during setup and sent it out over an LTE connection using an embedded eSIM.

In a statement on Oct. 10, Ledger confirmed that one impacted user's device contained an unauthorized hardware implant. It has not identified which models were affected.

Ledger also warned that because the implants leave the Secure Element, one of its key security features, intact, a tampered device may still pass the company's authenticity checks. That matters if you plan to verify a device yourself.

The company says the problem is not in its own operations:

"We have no indication that Ledger's infrastructure, systems or services or direct sales channel have been compromised."

In a follow-up update on Oct. 11, Ledger said all confirmed cases tied to the draining incident of Oct. 9 involve devices sold through CryptoBilis.

The Investigation Timeline So Far

• Oct. 9: the investigation becomes public after reports of stolen crypto linked to devices bought through CryptoBilis. The funds were drained that day.
• Oct. 10: Ledger confirms an unauthorized hardware implant in at least one impacted user's device.
• Oct. 11: Ledger says all confirmed cases involve CryptoBilis devices, and that its internal systems and direct sales channels are unaffected. It also says it is cooperating with authorities, tells distributors to source only through authorized channels and bans restocking of returned products.
• Oct. 13: Ledger describes the implant in detail. CTO Charles Guillemet said on X that the company is reviewing its reseller controls and anti-tamper protections, and invited researchers and other vendors to work with it on tamper detection and chain-of-custody practices.

The investigation is still trying to establish who tampered with the devices and where in the distribution chain it happened.

Loss Estimates Lie Between $86 Million and $94.5 Million

Ledger has not confirmed a figure, and the independent estimates do not agree.

Bitquery said it traced $93.2 million linked to the exploit, mostly USDT and TRON tokens taken from 315 wallets across six blockchains. Security research platform YFarmX put it higher: $94.5 million from 521 addresses across seven blockchains. Tether has frozen $10 million of USDT tied to the theft.

The pseudonymous investigator Specter said on X that more than $86 million may have been stolen from hundreds of wallets, with suspected theft addresses traced across Bitcoin, Ethereum and Tron. Other on-chain researchers have given a range of $86 million to $93 million from more than 300 wallets. Earlier estimates cited by the press ran as high as $93.2 million.

Ledger says it has not confirmed the total losses and has urged caution against speculation, so treat every number above as researchers' work rather than a settled total.

Why "Confined to CryptoBilis" Drew Pushback

Ledger's effort to keep the incident inside the CryptoBilis relationship has not gone unchallenged, because the reseller is listed as authorized on Ledger's own website. The authorized reseller page now shows CryptoBilis in Indonesia with the note "Sales temporarily paused", and the Shopee Mall Ledger Authorized Reseller Store in Malaysia carries the same note.

Since the investigation became public, users in other regions, including Europe, have reported suspected tampering in devices bought from retailers. Ledger says it is reviewing those reports of implants in other signers and locations.

Binance co-founder Changpeng Zhao alleged on X that the attackers apparently bought the reseller and made it sign a non-disclosure agreement. That claim has not been independently verified.

This is not the first hardware wallet supply-chain scare of the year. In July 2026, a flaw in Coldcard's seed-generation firmware let attackers drain an estimated $100 million to $130 million in bitcoin, per on-chain researchers.

For now, the practical line for anyone holding a device bought outside Ledger's direct channel is the one on its own support page: do not set up a device you have not yet initialized, and if you have, move to a new seed on a device from Ledger.