Ledger has halted reseller sales across seven Asian markets after confirming that hardware wallets sold by CryptoBilis were physically modified to capture customers’ 24-word recovery phrases and transmit them to an unauthorized party.
According to a BleepingComputer report dated October 14, 2026, Ledger opened an investigation on October 9 following reports of cryptocurrency losses from multiple users. The report does not provide loss figures or a count of affected customers.
Ledger said every confirmed loss involved a device sold by CryptoBilis, a reseller in Southeast Asia. Users have also reported suspicious devices from other retail channels in Asia and Europe, but those cases have not been confirmed by Ledger.
A separate component captures the seed phrase
Ledger’s Donjon security team found that the altered wallets contained an additional microcontroller. The implant detects and decodes the 24-word recovery phrase entered during wallet setup or restoration, then sends it over an LTE connection using a provisioned eSIM.
The component does not modify the wallet’s Secure Element or Ledger operating system, according to Donjon. It also leaves transaction and signature processing unchanged.
That design has a significant defensive consequence: Ledger’s integrity self-checks cannot detect the implant because the legitimate security components and software remain intact. A device can therefore pass those checks while an added component monitors the recovery phrase.
The technical findings broadly align with earlier reports from Mark Karpelès and Tibane Labs, according to the report.
For anyone confirmed to have used a modified unit, the implant’s documented purpose means the recovery phrase should be treated as exposed. The risk concerns control of the wallet itself: anyone who obtains the phrase can use it to restore the wallet elsewhere.
Sales suspended across seven markets
Ledger asked resellers and distributors to stop selling its wallets and remove existing products from shelves in:
- Indonesia
- Singapore
- Thailand
- the Philippines
- Vietnam
- Malaysia
- Hong Kong
The suspension is expected to remain in place while device-safety investigations continue. The report describes the action both as a request to sellers and as a broader halt covering distributors in those markets.
Ledger maintains that its infrastructure, services, internal systems and direct sales channel remain safe to use. That is the company’s position; the confirmed tampering described so far concerns devices distributed through CryptoBilis.
Separately, users have reported buying modified wallets from a Metapod technology retailer at an airport in Singapore and through MediaMarkt in Europe. These accounts have not been confirmed by Ledger. MediaMarkt, which obtains Ledger devices through Aqipa GmbH, removed the product from its shelves after the reports.
Trezor narrows its reseller network as a precaution
Trezor said it found no evidence that its own wallets had been compromised. The company nevertheless plans to reduce its reseller network, introduce an updated legal framework and increase oversight of how devices are sourced, stored and handled.
According to a letter sent to affected sellers, the relevant reseller partnerships will end on January 1, 2027, when their authorization to sell Trezor devices is revoked.
For Ledger customers, the purchase channel is now a critical part of assessing exposure. Devices confirmed as coming from CryptoBilis are within the identified incident, while reports involving other sellers remain unconfirmed. Ledger’s built-in integrity check, by itself, cannot exclude the implant described by Donjon.
