# Ledger halts sales in seven Asian markets after confirming a hardware implant that steals recovery phrases

The implant reads the 24 recovery words as they travel to the device screen and sends them out over a cellular modem, and reported thefts linked to one reseller exceed $86 million.

- Published: 2026-10-14T05:36:59.411Z
- Canonical: https://polylog.news/crypto/2026-10-14/ledger-halts-sales-in-seven-asian-markets-after-confirming-a
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Polylog editors](https://polylog.news), [Bitcoin Magazine](https://bitcoinmagazine.com/news/trezor-reduces-resellers-after-ledger-mess), [Bitcointalk Dev & Technical](https://bitcointalk.org/index.php?topic=5596402.0), [CoinDesk](https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen), [Zero Day](https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/), [The Block](https://www.theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442)

Ledger, the French hardware-wallet maker, [has asked resellers in Hong Kong and six Southeast Asian countries to pull its devices from shelves](https://t.me/cointelegraph/72648) while it investigates tampered units. [The Defiant reports](https://thedefiant.io/news/security/ledger-asks-resellers-to-halt-sales-in-seven-asian-markets) that the request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

The investigation became public on October 9. That day [CoinDesk reported](https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen) claims that more than $86 million had been drained from hundreds of wallets tied to devices sold by CryptoBilis, a Southeast Asian reseller. Some on-chain trackers put the total higher. Ledger has since [confirmed that at least one affected unit contained an unauthorized hardware implant](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-spy-implant-behind-crypto-thefts/). The company says it has no indication that its own infrastructure or its direct sales channel was compromised. It also says the only confirmed drains so far involve devices bought in Southeast Asia.

The attack did not break the secure element, the protected chip that generates and stores keys. According to [teardown findings reported by Kim Zetter](https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/), the implant monitors the unencrypted serial link between the secure element and the screen on a Nano X. It matches the letter shapes of the recovery words as the device displays them, stores the words, and transmits them through a built-in cellular modem and eSIM. Joe Grand, the hardware security researcher who took the device apart, describes two generations of the implant. The first used hand-soldered wires. The second used a thin flexible circuit laminated onto the original board, which is much harder to spot. Grand says [a user in Thailand first contacted him in August 2025](https://t.me/GokuCryptoNews/20972) after buying a cheap Nano X online only to salvage its battery.

The reports now go beyond one reseller. Ben Yorke, a crypto industry figure, says he bought a Ledger Flex [at Singapore's airport and noticed marks on the casing](https://t.me/GokuCryptoNews/20968). He never used the device. Mark Karpelès, the former Mt. Gox chief, opened it and says it contained an implant. [The Block reports](https://www.theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442) that MediaMarkt, the European electronics chain, has suspended Ledger sales. Trezor, Ledger's main competitor, [is reviewing and cutting its reseller list](https://bitcoinmagazine.com/news/trezor-reduces-resellers-after-ledger-mess). Commentators note that the risk from resold devices is old. Ledger [warned about tampered resold units in 2018](https://t.me/GokuCryptoNews/20970), and anyone can buy a device, modify it and return it into retail stock.

Each side has a reason to frame the incident its own way. Ledger has an interest in keeping the problem confined to one reseller and one region. Competitors such as Tangem [argue that device complexity created the attack surface](https://tangem.com/en/blog/post/ledger-cryptobilis-incident/). The technical facts so far support a narrower reading. The attacker defeated a path that works as designed: the screen has to receive the words in plaintext so that a human can read them. Any wallet set up on a tampered unit should be treated as compromised, whatever PIN protects it.

## What this means

The channel is distribution, not cryptography. Any device that shows a seed on a screen it receives from an unauthenticated bus can be turned into a transmitter by whoever handles it before the buyer. The exposed parties are Ledger's retail franchise in Asia and Europe, third-party resellers in general, and the self-custody pitch that holds keys safer outside institutions. The market already knows that seed phrases can be phished. It has not priced in the idea that a physical supply chain can deliver compromised keys at scale. The precedent is Ledger's 2020 customer-data leak, which produced years of phishing and physical threats but did not stop hardware-wallet adoption. The desk's read is that, within months, makers will move sales toward direct channels with tamper-evident verification. Over the same period, more risk-averse holders will move toward exchange-traded funds and qualified custodians. Two conditions drive this: confirmed implants keep appearing outside CryptoBilis stock, and they appear outside Southeast Asia. If Ledger's forensic work ties every case to one reseller, the effect will probably fade into a sales shift between brands rather than a retreat from self-custody.

## What to watch

- Whether Ledger or independent researchers confirm a drained wallet tied to a device bought outside Southeast Asia, because that would turn a reseller problem into a global supply-chain problem.
- Whether Ledger names where in the distribution chain the implants were installed, and whether police in Thailand, Singapore or the Philippines open cases, since attribution decides whether this was one criminal group or a wider operation.
- Whether other retailers in Europe follow MediaMarkt in suspending sales, because broad retail withdrawal would cut the most common route new self-custody users take.