TL;DR
Ledger asked resellers across six Southeast Asian countries and Hong Kong to halt sales and remove devices while its hardware-tampering investigation continues.
The company says confirmed incidents remain limited to Southeast Asia and found no indication that Ledger infrastructure, services or direct sales channels were compromised.
An unauthorized hardware implant was confirmed in one device, but the wider regional withdrawal is precautionary while Ledger Donjon investigates where physical tampering occurred.
Ledger has asked resellers and distributors across Southeast Asia and Hong Kong to suspend sales and remove hardware wallets from shelves while an investigation into tampered devices continues. In an October 13 update , the company named Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. The regional pullback is a precautionary expansion of Ledger’s response, not evidence that every device sold across those markets was compromised. Ledger said confirmed incidents remain limited to Southeast Asia and that its infrastructure, systems, services and direct sales channel show no indication of compromise. The episode puts hardware wallet security models under scrutiny.
Incident Update – Oct 13th, 2026
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices while the investigation is ongoing. This includes taking products off the shelves.
Specifically the countries are: Indonesia,…
— Ledger (@Ledger) October 13, 2026
Ledger Expands Sales Freeze as Tampering Investigation Continues
The investigation began after reports of missing funds involving devices sold through reseller CryptoBilis. Ledger later confirmed an unauthorized hardware implant in one affected customer’s signer and said its Donjon team was examining returned devices to determine who modified them and where in the distribution chain the tampering occurred. That confirmed implant supports a supply-chain attack scenario for affected devices, but it does not establish that Ledger’s Secure Element, operating system or internal infrastructure was breached. The distinction matters because self-custody security depends on supply-chain integrity as well as key isolation, firmware and verification.
Ledger’s broader sales suspension goes beyond the original pause involving CryptoBilis. Resellers in the seven named markets were told to stop sales and take products off shelves while the investigation proceeds. The company has not announced when regional sales will resume. The objective is to prevent potentially affected inventory from reaching customers while investigators map the scope and point of tampering. Ledger has also said it has not verified a drain linked to devices purchased elsewhere, leaving reports outside Southeast Asia unconfirmed. The case highlights why hardware-wallet procurement and verification remain separate controls from cryptographic protections inside the device.
The episode raises a broader question for hardware-wallet distribution: how manufacturers can maintain trust when third-party retail channels sit between secure hardware and users. Ledger’s response focuses on inventory withdrawal, device analysis and tracing where physical modification occurred rather than attributing every reported loss to one mechanism. Until the investigation establishes the full scope, the strongest confirmed finding is a tampered-device problem within part of the regional distribution chain, not a universal Ledger vulnerability. That distinction matters as manufacturers reassess reseller exposure and tighten hardware-wallet distribution controls .
