Ledger halts wallet sales across Asia after supply-chain attack

Ledger has asked distributors and resellers across Southeast Asia and Hong Kong to stop selling its cryptocurrency wallets and remove them from shelves while it investigates device tampering.

The move follows reports of cryptocurrency losses from devices purchased from CryptoBilis. Ledger said its investigation, launched on October 9, confirmed that some wallets sold by the reseller had been modified to steal recovery phrases and send them to an unauthorized party over LTE.

Ledger’s Donjon security team said the implant’s microcontroller can detect and decode the wallet’s 24-word recovery phrase, then transmit it over LTE using a provisioned eSIM. The implant is a separate component and does not alter the Secure Element, Ledger operating system, transactions, or signatures. As a result, Ledger’s integrity self-checks do not detect it.

Ledger said all confirmed fund losses involve devices sold by CryptoBilis, though users have also reported compromised devices from other sellers in Asia and Europe. MediaMarkt has removed Ledger products from its shelves following reports about devices sold through the retailer. It sources them from distributor Aqipa GmbH.

Ledger said its infrastructure, systems, services, and direct sales channel remain safe to use. Separately, Trezor said it had found no evidence its devices were compromised, but will end some reseller partnerships on January 1, 2027, as it tightens oversight.