• Ledger ordered resellers in six Southeast Asian markets and Hong Kong to halt sales and pull devices.

• Bitquery traced roughly $102 million in losses across 324 wallets as of October 13.

• Hidden circuit boards read 24-word recovery keys and sent them over LTE modules with eSIMs.

Sales Halt Across Southeast Asia

Ledger has told distributors and resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to stop selling its hardware wallets immediately and to clear the devices from physical shelves and online storefronts until its investigation is complete. The order widens a stop-sale that previously applied only to the distributor CryptoBilis, and the company still has not pinned down at which point in the supply chain the tampering occurred. Ledger describes the regional suspension as preventive: so far it has found no sign of intrusion into its internal systems, software, firmware or officially operated direct sales channels.

What the company has confirmed is how the compromised units work. Unauthorized circuit boards were concealed inside the housing and beneath the display. When a buyer initializes a device for the first time and the screen shows the 24-word Ledger recovery key, a microcontroller in the implant reads the on-screen text and forwards it over an LTE module fitted with a pre-configured eSIM. With that key in hand, attackers can reconstruct the wallet on hardware they control, without touching the victim's device again or persuading anyone to sign a transaction. The implant does not defeat the Secure Element, Ledger's operating system or transaction signing, which is why tampered units can still pass the Genuine Check: that function proves the security chip is authentic but cannot detect circuitry added around it. Losses are climbing. On-chain analytics firm Bitquery reported that, as of October 13, roughly $102 million had been drained from 324 wallets across Tron, Bitcoin, Ethereum, Solana, BNB Chain and Polygon, up from earlier estimates of $86 million to $93 million. Tether has frozen about $10 million in USDT across 20 addresses, and around $84 million remains traceable on-chain. Attackers have pushed roughly 6,840 ETH into Tornado Cash, a crypto mixer, and routed other funds through Zcash and an atomic swap service such as THORChain, complicating tracing and recovery. Ledger has not verified the victim count or the final total; the $102 million stands as an independent on-chain estimate.

The trail began on October 9, when reports linked stolen funds to wallets created with devices bought through CryptoBilis. In the days that followed, users elsewhere, including in European markets, reported that units purchased through ordinary retail channels also appeared tampered with. On Tuesday, Ledger said in an update posted on X that the investigation is ongoing and is aimed at identifying who handled the devices and at which stage of the supply chain the modification took place. The suspension order covers resellers across the seven named markets and goes beyond the earlier demand that CryptoBilis stop sales and shipments. Ledger says it has no evidence that its infrastructure, internal systems, services or official direct channels were breached, and that confirmed incidents so far are confined to Southeast Asia; it has not established any link between devices bought in other regions and theft. Open questions remain: the company has not published full findings, has not confirmed how many devices are affected, and has not said whether manufacturing, distribution or retail is the source. Consumer complaints are adding pressure. On-chain researcher 0xQuit has suggested CryptoBilis may not be the only channel where tampered units surfaced, urging owners to inspect their devices, though Ledger has not confirmed that view and dismantling a sealed unit is not an official detection procedure. One user reported buying a Ledger Flex from a shop at Singapore Changi Airport in late June, keeping the box sealed, and still finding a complete antenna, battery, eSIM and LTE module inside. A Singapore-based lawyer has publicly pressed the company for clearer, faster consumer guidance than a standard support ticket, citing a device allegedly bought from a large local electronics retailer. No unified compensation plan has been announced.

Why a Region, Not a Batch

Our reading is that the shift from a single distributor to seven markets means Ledger still cannot locate the tampering point; a company that had isolated a bad batch would recall the batch, not a region. The Genuine Check blind spot is the deeper problem: cryptographic verification of the secure chip cannot see added circuitry, so physical inspection remains the only reliable consumer-side test. Holders of unopened units should not initialize them, and set-up owners should move assets to a clean device with a newly generated key rather than restoring the original 24 words; anyone asking for that key by phone or private message is attempting fraud, since Ledger says it never requests it that way. Readers setting up a replacement device can also consult our guide to staking Cardano (ADA) with a Ledger hardware wallet.