Ledger Probes Tampered Wallets in Southeast Asia as Trezor Trims Reseller Network

Hardware wallet manufacturer Ledger has asked resellers across six Southeast Asian countries and Hong Kong to suspend sales of its devices, escalating an investigation into tampered hardware wallets capable of stealing users' recovery phrases. In a post on X, Ledger confirmed that the request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong, while stressing that confirmed incidents remain "contained to Southeast Asia" and that no drain has been verified from devices purchased elsewhere. The broader suspension expands on Ledger's earlier request for reseller CryptoBilis to halt sales and shipments, after reports emerged on October 9 of stolen crypto linked to devices purchased through that channel.

At least one Ledger device sold by CryptoBilis contained an unauthorized hardware implant designed to capture recovery phrases and transmit them over cellular networks, according to Ledger's findings. The device reportedly worked by reading information displayed on the screen of the wallet rather than by tampering with firmware, a method that may have circumvented some existing supply chain defenses. Blockchain investigators have estimated potential losses between $72 million and $86 million, though Ledger said it has not independently confirmed that figure.

The incident has had ripple effects across the hardware wallet industry. European electronics retailer MediaMarktSaturn has removed Ledger products from stores and online platforms, while rival Trezor announced it is reducing its authorized reseller network as a precaution. Chief Commercial Officer Danny Sanders said affected resellers will lose their authorized status on January 1, with shipments to those businesses stopping immediately. Trezor emphasized that it has no evidence its own devices were compromised and that its existing checks can detect counterfeit units and modified firmware.

The episode has renewed scrutiny over hardware wallet supply chain security, a long-standing concern in the self-custody sector where consumers rely on physical devices to safeguard digital assets. With reported losses potentially in the tens of millions and at least one confirmed hardware implant circulating through legitimate retail channels, the investigation is now drawing attention from regulators and competitors alike. Ledger said its investigation is ongoing to determine who tampered with the devices and at what point in the distribution chain the compromise occurred.