Ledger Halts Asian Wallet Sales After Supply-Chain Attacks

Cryptocurrency hardware wallet manufacturer Ledger has instructed resellers and distributors across Southeast Asia and Hong Kong to suspend device sales and clear inventory following the discovery of compromised hardware.

The precautionary sales halt covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. The intervention follows an internal investigation launched on October 9 after multiple users reported unexpected cryptocurrency losses.

Ledger confirmed that devices purchased through Southeast Asian reseller CryptoBilis had been physically modified to intercept and exfiltrate user funds. Technical analysis by Ledger’s Donjon security division revealed that a secondary microcontroller had been installed inside the tampered wallets.

The malicious implant monitors the setup process, decodes the 24-word recovery phrase required to restore or initialise the wallet, and transmits the sensitive data over an LTE connection via a provisioned eSIM. Because the hardware implant operates independently without altering the core Secure Element or operating system, standard self-integrity checks performed by the device cannot detect the modification.

While confirmed financial losses remain tied to devices sourced from CryptoBilis, investigators have received user reports regarding modified products purchased from other vendors in Asia and Europe. European electronics retailer MediaMarkt subsequently pulled the product line from its shelves following similar customer notifications.

Ledger maintains that its direct sales channels, manufacturing infrastructure, and proprietary systems remain secure. Meanwhile, competitor Trezor announced independent measures to streamline its own authorized reseller network and enforce stricter vetting protocols to mitigate downstream supply-chain risks.