Ledger has asked resellers in Southeast Asia and Hong Kong to stop selling its devices while it investigates wallets fitted with a hidden implant. The company says the only confirmed incidents remain in Southeast Asia, while an onchain investigator has traced more than $86 million in suspected thefts.
Ledger asked resellers and distributors in Southeast Asia and Hong Kong to stop selling its hardware wallets and take them off the shelves. The company said in a tweet on Tuesday that it is investigating devices fitted with a hidden implant. The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.
Confirmed cases stay in Southeast Asia
Ledger said the only confirmed incidents remain in Southeast Asia, and that it has not verified a drain linked to a device bought elsewhere. The company has previously said all confirmed losses involve devices sold through CryptoBilis, a reseller in the region.
Ledger is still working to establish who tampered with the devices and at what point in the distribution chain. It said it has no indication that its own infrastructure, systems, services or direct sales channel have been compromised.
How the implant works
Ledger's Donjon security team found that the implant reads the 24-word recovery phrase from the device's screen during setup and sends it out over LTE. Anyone holding that phrase can restore the wallet and move its funds. Ledger told buyers who already set up a CryptoBilis device to move their assets to a new device with a new recovery phrase, and not to restore any seed phrase on such a device.
Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger says it has not verified.
Retailers and rivals respond
Earlier on Tuesday, MediaMarkt Saturn stopped selling Ledger devices in its stores and online, with Ledger's agreement, after a customer in Germany reported an implant. Ledger said no loss of funds was reported in that case.
Rival maker Trezor said it will end its authorizations for resellers on January 1, 2027. Trezor described the move as a precautionary measure and said there was no evidence that its own devices had been compromised.
Source: Decrypt
Trading involves risk.
Risk Disclaimer
