Ledger has expanded its response to a hardware-wallet supply-chain attack, asking resellers and distributors across six Southeast Asian countries and Hong Kong to suspend sales and remove its devices from shelves. The October 13 precautionary order covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong while Ledger investigates where unauthorized hardware implants entered the distribution chain.

In its October 13 incident update, Ledger said confirmed fund-loss cases remain contained to Southeast Asia and that it has not verified a drain linked to a device purchased elsewhere. The wider retail suspension therefore represents containment of a potential distribution risk, not confirmation that every Ledger device sold across those markets was compromised. Ledger also says its infrastructure, services and direct sales channel show no evidence of compromise.

Incident Update – Oct 13th, 2026

Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices while the investigation is ongoing. This includes taking products off the shelves.

Specifically the countries are: Indonesia,…

— Ledger (@Ledger) October 13, 2026

Hardware Implant Bypassed the Normal Trust Boundary

Ledger’s Donjon security team determined that an unauthorized component inside affected devices could monitor information sent to the display during initial setup. When the signer displayed its 24-word recovery phrase, the implant’s microcontroller decoded those words and transmitted them over LTE using a provisioned eSIM. The attack targeted the recovery secret before users began normal wallet operations rather than breaking Ledger’s Secure Element or cryptographic signing process.

That distinction makes the incident fundamentally different from a conventional firmware exploit. The implant operated as an additional physical component and did not modify Ledger OS, transactions or signatures. A device could therefore continue behaving normally while its root recovery secret had already been exposed. Once an attacker possesses the recovery phrase, the original hardware wallet no longer needs to be contacted to reconstruct the accounts and authorize withdrawals elsewhere. Independent cybersecurity reporting has similarly characterized the incident as a physical supply-chain compromise rather than a breach of Ledger’s core systems.

Updated on-chain analysis from Bitquery estimates that approximately $102 million was removed from 324 wallets across TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana. TRON accounted for roughly $79.3 million of that reconstructed total, followed by Bitcoin at $16.8 million. Those figures remain an independent forensic estimate rather than a Ledger-confirmed loss total. Bitquery says its calculation counts assets leaving victim wallets and excludes later movements between attacker-controlled addresses to reduce double counting.

Supply-Chain Security Moves Beyond CryptoBilis

The investigation initially centered on CryptoBilis, an authorized Ledger reseller operating in Indonesia, Malaysia and the Philippines. Ledger first asked the company to halt sales and shipments after customers reported unauthorized withdrawals on October 9. The subsequent regional suspension materially widens the response. Ledger is now investigating the integrity of a broader reseller and distribution pathway while attempting to determine who modified the devices and at what point before they reached customers.

The case adds a physical-distribution dimension to previous wallet supply-chain failures. A compromised Trust Wallet browser-extension release exposed users through a software distribution channel, while the Coldcard incident involved weak seed-generation entropy in affected firmware. Each incident compromised wallet security at a different boundary, reinforcing that hardware isolation alone cannot protect funds when seed generation, software distribution or physical supply chains fail.

The fallout is already extending beyond Ledger. OneKey has dropped CryptoBilis as an authorized reseller and begun reviewing its wider distribution network, despite reporting no losses among its own customers. Separately, MediaMarkt Saturn paused Ledger sales in Europe after a customer in Germany reported an implanted device, although no associated fund loss has been confirmed there. The security question has consequently shifted from whether an implant exists to how broadly compromised hardware entered legitimate retail channels.

Ledger continues to advise CryptoBilis customers who have not initialized their devices not to do so, while users who already configured one are being directed to move assets to a different signer using an entirely new recovery phrase. Reusing the potentially exposed 24-word phrase on replacement hardware would preserve the compromise rather than remediate it. The investigation now depends on physical forensics of returned devices and distribution records to determine the actual scope of the attack.