Ledger has widened its response to the hardware-tampering crisis, asking resellers and distributors across seven Asian markets to suspend sales and take its devices off shelves while investigators work to establish where in the distribution chain wallets were altered.
In an October 14 incident update, the company said the request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong — extending an earlier sales suspension involving CryptoBilis, the reseller linked to the first confirmed cases. The move was reported by The Crypto Times and by The Hacker News, which noted Ledger is asking resellers across Southeast Asia and Hong Kong to stop selling while the investigation continues.
A precaution, not a confirmed compromise everywhere
Ledger framed the seven-market suspension as a precaution. The company said confirmed incidents remain contained to Southeast Asia, that it has not verified any fund drain linked to a device purchased outside the confirmed cases, and that it still has no indication its own infrastructure, systems, services or direct sales channel were compromised. Its security research team, Ledger Donjon, is examining recovered devices.
The suspension by itself does not establish that devices sold in all seven markets were tampered with. It signals that Ledger can no longer assume the alteration happened at a single reseller — and that the chain of custody, not the factory, is now the working perimeter of the investigation.
A second point of sale: Singapore Airport
The expansion coincides with a new report that changes the shape of the investigation. Former Mt. Gox chief Mark Karpelès reported a suspected spy implant in a Ledger Flex purchased at Singapore Airport — from Metapod, not CryptoBilis. The device belonged to Ben Yorke of WOO, who noticed suspicious marks on the hardware and sent it for inspection rather than using it. Karpelès shared photographs and a teardown walkthrough describing the suspected component.
The report matters because it is a different device model — a Flex rather than the Nano X involved in earlier findings — and a different retailer. It raises the question of whether the tampering extends beyond one reseller's inventory or reflects a wider distribution channel. Ledger has not confirmed any connection between the Singapore device and the CryptoBilis-linked fund drains, and the finding should be treated as a separate reported case pending the company's examination.
Rival makers respond
Karpelès separately said he found no implant in a Trezor device he examined and had received no reports of similar tampering involving Trezor hardware — a narrow statement about devices he has personally inspected, not a comprehensive review. Trezor has nonetheless overhauled its own reseller network in the days since the Ledger findings, saying it had no evidence its devices were compromised.
Where the case stands
The confirmed facts remain: Ledger has verified an unauthorized hardware implant in at least one device sold through CryptoBilis, whose security team says the component read the 24-word recovery phrase from the screen during setup and transmitted it over a cellular connection — leaving the Secure Element and signing process untouched. Loss estimates from on-chain researchers range from roughly $86 million to more than $92 million across roughly 300 wallets; Ledger has not confirmed a final total, and no perpetrator has been identified.
For users, the guidance is unchanged: do not initialize unused devices bought from affected channels, regenerate a new recovery phrase on a device from a verified direct channel, and treat any "Ledger support" outreach asking for a seed phrase as phishing.
TrustGrade's prior coverage: the initial reseller investigation, the implant confirmation, the laundering trail and OneKey's reseller purge.
TrustGrade tracks the security posture of platforms and protocols in digital assets. Verified trust data: trustgrade.ai.