Ledger has asked distributors and resellers in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, and Malaysia) and Hong Kong to stop selling and displaying its devices. Based on BleepingComputer and official updates (2026-10-13 to 14), the investigation has expanded into LTE/eSIM implants found through channels such as CryptoBilis. Reports say the Secure Element and OS were not tampered with, suggesting this is more of a supply-chain risk. When buying, check that the seller is an official direct retailer, the packaging is sealed, and all accessories are included. Don’t enter your seed phrase on a suspicious device.
❓ 【Why suspend sales in Asia too?】
1. Ledger said that, during its investigation, it asked resellers and distributors in six Southeast Asian countries and Hong Kong to stop sales and remove products from display.
2. The incident involved a hardware implant found in a device sold by Malaysian reseller CryptoBilis. According to analysis by Donjon and others, the implant could intercept the 24-word recovery phrase during setup and transmit it over LTE.
3. Ledger said that confirmed losses of funds were mainly limited to devices from the CryptoBilis channel, and that it had not yet verified any leaks linked to devices purchased in other regions.
4. Reports about MediaMarkt in Europe dropping or temporarily suspending sales are part of the same investigation, but the main article focuses on the expansion of the issue to Asian channels.
5. Rather than taking this as a reason to throw everything away out of fear, it’s better to treat it as a prompt to recheck “where you bought it and whether the seal is intact.”
❓ 【Why are official direct-sales channels generally safer?】
1. Ledger emphasized that there were no signs that its infrastructure, systems, services, or direct-sales channels had been compromised. Tampering during the supply chain or distribution is a different kind of issue.
2. Comparing your purchase with official direct-sales channels or the list of authorized resellers on the official website can reduce the opportunity for tampering that increases with longer distribution chains.
3. Airport shops, unauthorized marketplaces, ultra-cheap “unopened” devices, and secondhand devices that have already been activated are especially ill-suited to this type of incident. They’re not recommended.
4. Don’t rely on the brand name alone. Keep your purchase receipt, photos of the packaging, and records of any serial number checks. These can serve as evidence if you need to contact official support later.
5. News about other brands, such as Trezor, reducing their number of resellers is a separate matter. This article focuses only on the Ledger issue involving Asian sales channels.
❓ 【What should I check about the seal and accessories when it arrives?】
1. First, check the packaging tape, shrink wrap, and lid for signs they may have been reattached (lifting, adhesive residue, or loose wrapping). A seal alone can’t provide a 100% guarantee, but it’s a first-line check.
2. Right after opening it, check whether the included items differ from the official guide and look for USB devices, cables, unusual modules, or extra wiring.
3. If the screws, seams, or case color look off, or you see signs of disassembly, stop using the device immediately. Do not reset it or enter your recovery phrase.
4. If you can verify the serial number and device information through the official authentication process, follow those instructions. Use only official domains for apps and websites.
5. If anything seems suspicious, contact the seller and official support before connecting the device, and keep photos of the packaging and unboxing.
❓ 【What if it only shows the recovery phrase on the screen?】
1. The recovery phrase (seed) should appear only on the device screen, and you should write it down by hand. If a computer or phone pop-up, chat, or “customer support” asks for your recovery phrase, treat it as phishing.
2. The reported implant is a separate component that does not interfere with the Secure Element or Ledger OS, so a device integrity check alone may not detect it. That’s why the key rule is: “Never enter your recovery phrase on a suspicious device.”
3. Don’t transfer an existing wallet to a “preconfigured device,” a “device reset by someone else,” or an “opened device received as a gift.”
4. If you’ve already bought a device, check it against the latest official security notices and the purchase channel. If it’s from a confirmed affected channel, follow the guidance on transferring assets and contacting support.
5. If you suspect a problem, prioritize small-value tests, preserving evidence, and contacting official support. Don’t disassemble the device yourself to “experiment” and then use it for your main wallet.
❓ 【Frequently asked questions】
Q. Do I need to throw away a device I’ve already bought?
A. Not necessarily. Check it against official guidance and the purchase channel. If it’s from a confirmed affected channel, follow the guidance on transferring assets and contacting support.
Q. Is it okay to buy from secondhand or unauthorized sellers?
A. Not recommended. The key issue in this case is tampering during distribution and resale, so prioritize official direct-sales channels and authorized seller lists.
Q. Is this the same kind of news as Trezor reducing its number of sellers?
A. That’s a separate brand. The main article focuses only on Ledger’s request to halt sales in Asia and Hong Kong and on checking purchase channels.
Q. If this is a supply chain attack, does that mean Ledger’s software was compromised?
A. Based on reports and official updates, the Secure Element and OS were not tampered with. The implant is a separate component that can intercept the recovery phrase and transmit it. Ledger said there were no signs of compromise to its infrastructure or direct-sales channels.
Q. What if I’ve opened it and the seal looks questionable?
A. Stop before entering a recovery phrase or setting up the device. Take photos of the packaging and device, then contact the seller and official support. Even “just testing it once” is risky.
Risk notice: Crypto assets are highly volatile, and you could lose your entire principal. This article summarizes checks on Asian sales channels and purchases based on public reporting (including BleepingComputer) and company updates. It is not investment advice, a recommendation of any particular coin, a price prediction, or a guarantee of absolute safety. Follow official primary announcements for device and channel status. Comply with the laws in your area, use only money you can afford to lose, and don’t trust unofficial support services or suspicious devices.
\u003ct-138/\u003e \u003ct-140/\u003e \u003ct-142/\u003e \u003ct-144/\u003e #AsiaSalesSuspension