What happened

Ledger has told its authorized resellers and distributors in six Southeast Asian countries and Hong Kong to stop selling its hardware wallets and pull existing stock off the shelves while it investigates devices fitted with a covert implant. The reason the request matters more than a typical recall notice: the implant does not touch the chip, the operating system or any transaction, according to Blockhead. It defeats the wallet’s entire security model from outside it, by reading the recovery phrase off the screen and phoning it home.

Key Takeaways

  • Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove devices from shelves, per a company tweet cited by Decrypt.
  • The implant’s microcontroller reads the 24-word recovery phrase as it appears on screen during setup and transmits it over LTE via an eSIM, according to Blockhead.
  • Onchain investigator Specter has traced more than $86 million in suspected thefts tied to the incident; Ledger says it has not verified that figure.
  • Every confirmed loss so far traces to CryptoBilis, a Southeast Asian reseller, though a second tampered device has now surfaced in Singapore from a different retailer, and a customer in Germany flagged an implant to MediaMarkt Saturn.
  • Rival maker Trezor is cutting its reseller network effective January 1, 2027, calling it a precautionary step with no evidence its own hardware was compromised.

The mechanism: a chip that reads the screen, not the Secure Element

The attack works because the implant sits physically inside the device enclosure and watches what the screen displays, rather than attacking the cryptography itself. Ledger’s Donjon security lab found that during wallet setup, a microcontroller captures the 24-word recovery phrase as it’s shown on screen and sends it out over the mobile network using an embedded SIM, according to Blockhead. Once an attacker has that phrase, they can restore the wallet on any other device and move the funds, no password or second factor required.

Ledger has been explicit that this did not involve a flaw in its chip, operating system or servers. In its own incident response, the company said “there was no flaw in Ledger’s chip, operating system or servers,” framing it instead as “an attack on the distribution channel after the devices left our control.” Blockhead adds that the implant did not alter the Secure Element, the OS, or any transaction, consistent with Ledger’s framing that this sits outside the product’s core security boundary.

Scope: one confirmed reseller, a widening set of reports

Ledger’s investigation keeps the confirmed losses narrow even as the geographic response widens. The company says the only confirmed incidents remain in Southeast Asia and that it has not verified a drain linked to a device bought elsewhere, with every confirmed loss tied to CryptoBilis, a regional reseller, per Decrypt. Ledger dates the incident to October 9, according to Blockhead.

But the sales suspension itself now spans Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, a wider net than the single reseller tied to confirmed losses. Blockhead reports a second tampered unit has surfaced: a Ledger Flex belonging to Ben Yorke of WOO, bought from a retailer called Metapod at Singapore’s airport. Former Mt. Gox CEO Mark Karpelès tore the device down and found a spy implant, which would make it the first reported tampered unit sold outside CryptoBilis, though Ledger has not confirmed a link between the two cases. Separately, MediaMarkt Saturn pulled Ledger devices from its stores and website, with Ledger’s agreement, after a German customer reported an implant, though no funds were lost in that case, per Decrypt.

Ledger describes the operation as patient and well-funded rather than opportunistic. In its response, the company said attackers “bought genuine Ledger devices, opened them, fitted custom-built hidden components designed to capture the recovery phrase during setup, and put them back into distribution,” building their own servers to collect phrases and infrastructure to drain and launder funds over several months. CoinScreamer notes that account remains Ledger’s own assessment: the company has not published a verified total of affected wallets, named the attackers, or set a date for resuming sales in the paused markets.

Industry response diverges on how far to go

Ledger and Trezor are responding to the same incident with different scopes. Ledger’s changes target handling practices within its existing network: devices should no longer sit on shelves or displays, stock should stay in back-of-store storage and be handed over only at purchase, and resellers must report unusual customer complaints promptly, while returned units can never be resold even if they appear unopened, according to CoinScreamer and Ledger’s own statement.

Trezor, by contrast, is shrinking its reseller network outright. The company said it will end authorizations for some resellers on January 1, 2027, with chief commercial officer Danny Sanders calling it “a precautionary measure to protect our supply chain and our customers” in a letter to partners, per Blockhead. Affected resellers can still sell existing inventory through the holiday season but will receive no new stock and will be dropped from Trezor’s authorized list. Trezor said there is no evidence its own devices have been compromised.

What to Watch

Ledger has given no date for lifting the sales suspension in the seven affected markets, and it has not published a verified count of compromised devices or stolen funds, per CoinScreamer. The company says it is working with law enforcement and the security community to trace the funds and dismantle the attackers’ infrastructure, and has promised a fuller technical disclosure “when we can,” according to its own statement. Whether the Singapore device reported by Mark Karpelès turns out to be linked to the CryptoBilis cases, or represents a separate point of compromise in the distribution chain, remains unconfirmed by Ledger.

Sources