Southeast Asia at Center of Scandal
Ledger, a leading manufacturer of hardware wallets, has called for an immediate halt to sales across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong.
The scale of the breach is significant: research cited by blockchain investigator Specter and cybersecurity group Yfarmx estimates losses could be as high as $86 million or even $103 million. However, Ledger has not confirmed these figures or released its own tally of affected customers. The company’s investigation is ongoing and aims to pinpoint both who is responsible for the tampering and at what point in the distribution chain it occurred.
Ledger’s request for sales suspension was issued to resellers on October 9, following public reports of compromised devices linked to CryptoBilis.
Despite the focus on Southeast Asia, users in regions such as Europe have also reported suspicious devices purchased from retailers—raising concerns that the problem may not be geographically isolated.
Retailer CryptoBilis Under Scrutiny
CryptoBilis, an authorized Ledger reseller operating in Indonesia, Malaysia, and the Philippines, has become a focal point for investigators after multiple reports surfaced of compromised wallets sold through its channels. On Saturday following public disclosure of losses, CryptoBilis suspended all hardware wallet sales—not just for Ledger but for all brands it carried—across its Southeast Asian markets. This followed confirmation from Ledger’s security team that at least one device sold by CryptoBilis contained a hardware implant.
The sophistication of this attack stands out: according to cointelegraph.com, implanted microcontrollers inside affected Ledgers were able to intercept users’ 24-word recovery phrases during device setup and transmit them over cellular networks using embedded SIM cards. These recovery phrases are essentially the keys to users’ crypto holdings; once exposed, funds can be drained remotely. Notably, Ledger Donjon—the company’s internal security unit—determined that while these implants extracted recovery phrases, they did not alter transactions or compromise Ledger’s core security chip.
Still, the breach has left many users reeling and looking for answers about how such implants could evade detection until now.
See Also
Europe Sees Suspicious Ledger Devices
Although confirmed incidents are currently concentrated in Southeast Asia, recent events in Europe suggest broader risks. MediaMarktSaturn—the parent company behind electronics giant MediaMarkt—pulled all Ledger products from shelves and online platforms internationally after a German customer reported finding unauthorized cables and cellular modules inside two separate wallets bought from different stores. As of now, there have been no confirmed fund losses linked to these European cases.
This swift response highlights a tension: on one hand, Ledger insists there is no indication that its infrastructure or direct sales channels have been breached; on the other hand, physical tampering appears possible even within established retail environments. Former Mt. Gox CEO Mark Karpelès added to concerns when he revealed that a Ledger Flex device purchased at Singapore’s airport contained an illicit spy implant—a high-profile example underscoring how difficult it may be to police every node in global distribution chains.
Trezro Tightens Reseller List
The fallout from Ledger’s troubles has rippled across the hardware wallet industry. Trezor—another major wallet provider—announced it would reduce its number of authorized resellers beginning January 1 as a “preventive step” despite stating there is “not a single piece of evidence” that Trezor devices have been compromised.
Danny Sanders, Trezor’s chief commercial officer, notified select resellers this week that shipments would cease starting Tuesday. CryptoBilis—which is also an authorized Trezor reseller—immediately suspended all hardware wallet sales during the investigation into the Ledger breach. The move signals heightened caution industry-wide: even companies not directly affected are reevaluating their supply chains amid fears of similar attacks.
The headline numbers around losses—$72 million to $103 million depending on which estimate you trust—underscore just how much is at stake as both consumers and manufacturers reassess what “secure storage” really means when physical tampering enters the equation.
What investors will be watching
Investors will be watching for the results of Ledger’s ongoing investigation into tampered devices, particularly whether confirmed incidents expand beyond Southeast Asia or are linked to cases reported in Europe, as Ledger has not yet confirmed the total number of affected users or value lost.
