19 OCT 2026 — Ledger is investigating how its crypto hardware wallets sold in Southeast Asia came to contain hidden implants that record the 24-word recovery phrase. The company says a criminal group spent months buying genuine devices, adding the implants and pushing them back into shops in the region. In a statement dated 15 October, it told its authorised sellers across Southeast Asia and in Hong Kong to pause sales during the investigation. It gave no date for sales to resume.
Ledger says its own chip, operating system and servers were never breached. On its account, the attack happened after the devices left its hands, somewhere in the retail chain.
How the attack worked
According to Ledger, the group bought genuine wallets, opened them and fitted custom-built hidden parts that captured the 24-word recovery phrase as the owner set the device up. The units were then returned to circulation through resellers. Whoever holds that phrase can rebuild the wallet on any other device and empty it.
Ledger's security lab, the Donjon, took the implant apart. BleepingComputer reported on 14 October that the lab found a microcontroller that detects and decodes the phrase, then sends it out over LTE using a provisioned eSIM. The add-on sits beside the secure element instead of altering it, so the wallet's integrity checks do not flag it and transactions and signatures stay untouched.
The attackers were organised. Ledger said they built their own servers for collecting seeds and for draining and laundering funds, and described them as patient people who "spent millions" before striking in one coordinated operation.
From one reseller to seven markets
The case surfaced on 9 October. Ledger opened an investigation into users' reports of lost funds and asked a Malaysia-based reseller to stop selling and shipping its devices, according to BleepingComputer. A day later Ledger confirmed that at least one affected user's device "contained an unauthorized hardware implant".
On Tuesday 13 October Ledger widened the request to every reseller and distributor in Hong Kong, Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam, including removing stock from shelves. "To be clear, as the investigation continues, the only confirmed incidents remain contained to Southeast Asia," Ledger said on X, as quoted by Cointelegraph in its report. It added that it had not verified any drain linked to a device bought elsewhere.
Ledger has tied every confirmed loss so far to devices sold through that reseller, according to BleepingComputer. It has not said who tampered with them, and its own account places the blame on a criminal group that pushed the units through resellers. RECATOOLS found no record of any authority accusing that reseller or any other seller of wrongdoing.
A device turns up in Singapore
The scare did not stay with one shop. Blockhead reported that Mark Karpelès, the former head of Mt. Gox, posted a teardown on 13 October of an unused Ledger Flex he said carried a spy implant. Its owner said it had been bought from a retailer at Singapore's airport, so not the Malaysian reseller. Ledger has not confirmed any connection between that unit and the earlier cases.
In Europe, the electronics chain MediaMarkt Saturn pulled Ledger products, with Ledger's agreement, once a German customer reported finding an implant. No loss of funds was reported there. Ledger said its teams spot-bought and opened devices from stores, Germany included, and checked warehouse samples. "Every unit examined was clean," it said.
The money, and what is not known
The headline loss figure is not Ledger's. According to Blockhead, an onchain investigator known as Specter puts suspected thefts at more than $86 million, and Ledger says it has not verified that number. Its 15 October statement gives no count of victims, and Ledger earlier described the volume of affected devices only as "limited", according to BleepingComputer.
Ledger called the incident "a localized distribution attack" rather than a systemic supply-chain failure. It said it is helping police and security researchers trace the stolen funds, thanked partners including SEAL_911, and promised a fuller technical disclosure when it can.
New rules for shops, and for rivals
Ledger has told its authorised network that returned devices can never be resold, however new they look. Products must also come off shelves and displays and stay in the back until the moment of sale, and sellers must report any customer complaint about an unusual product promptly.
Trezor, a rival wallet maker, said it found no evidence its own devices had been compromised but will still cut its reseller list. Affected partners lose their authorisation on 1 January 2027. Its chief commercial officer, Danny Sanders, called it "a precautionary measure to protect our supply chain and our customers," Blockhead reported.
Scammers follow the headlines
Scammers have already turned the fear into bait. On 16 October Protos reported that the security firm SlowMist had flagged a fake "firmware update" email telling recipients to connect their wallet to "protect your device against emerging spyware threats, such as recent incidents in Malaysia."
Ledger's phishing guidance says it does not email users asking them to update firmware, and that the 24 words should only ever be typed into the device itself. For anyone who bought from the Malaysian reseller, Ledger's advice was not to begin setup at all, and to move funds to a new device with a new seed if setup was already done. Ledger warns that Genuine Check cannot spot an added implant when the original secure element is intact, so a passing check is no guarantee.
