Ledger halts sales in seven Asian markets after confirming a hardware implant that steals recovery phrases

Ledger, the French hardware-wallet maker, has asked resellers in Hong Kong and six Southeast Asian countries to pull its devices from shelves while it investigates tampered units. The Defiant reports that the request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

The investigation became public on October 9. That day CoinDesk reported claims that more than $86 million had been drained from hundreds of wallets tied to devices sold by CryptoBilis, a Southeast Asian reseller. Some on-chain trackers put the total higher. Ledger has since confirmed that at least one affected unit contained an unauthorized hardware implant. The company says it has no indication that its own infrastructure or its direct sales channel was compromised. It also says the only confirmed drains so far involve devices bought in Southeast Asia.

The attack did not break the secure element, the protected chip that generates and stores keys. According to teardown findings reported by Kim Zetter, the implant monitors the unencrypted serial link between the secure element and the screen on a Nano X. It matches the letter shapes of the recovery words as the device displays them, stores the words, and transmits them through a built-in cellular modem and eSIM. Joe Grand, the hardware security researcher who took the device apart, describes two generations of the implant. The first used hand-soldered wires. The second used a thin flexible circuit laminated onto the original board, which is much harder to spot. Grand says a user in Thailand first contacted him in August 2025 after buying a cheap Nano X online only to salvage its battery.

The reports now go beyond one reseller. Ben Yorke, a crypto industry figure, says he bought a Ledger Flex at Singapore's airport and noticed marks on the casing. He never used the device. Mark Karpelès, the former Mt. Gox chief, opened it and says it contained an implant. The Block reports that MediaMarkt, the European electronics chain, has suspended Ledger sales. Trezor, Ledger's main competitor, is reviewing and cutting its reseller list. Commentators note that the risk from resold devices is old. Ledger warned about tampered resold units in 2018, and anyone can buy a device, modify it and return it into retail stock.

Each side has a reason to frame the incident its own way. Ledger has an interest in keeping the problem confined to one reseller and one region. Competitors such as Tangem argue that device complexity created the attack surface. The technical facts so far support a narrower reading. The attacker defeated a path that works as designed: the screen has to receive the words in plaintext so that a human can read them. Any wallet set up on a tampered unit should be treated as compromised, whatever PIN protects it.