Protocols & Policy · Wallet security
Ledger Pulls Devices in Seven Asian Markets, Finds No Tampering in Germany
Ledger asked resellers in Southeast Asia and Hong Kong to stop selling its wallets during its CryptoBilis implant investigation, and said on Oct. 14 that its security team found no tampered units in German retail and distributor stock.
Ledger has asked resellers and distributors in seven Asian markets to stop selling its hardware wallets and take them off the shelves, the French wallet maker said in an incident update on Oct. 13 (source 1). The markets are Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong (source 1).
A hardware wallet, which Ledger now calls a signer, is a small device that stores the keys controlling a user's crypto. The suspension widens a response that until Oct. 13 centered on one Southeast Asian reseller, CryptoBilis, whose devices Ledger says carried an unauthorized hardware implant (source 3). Le Coin reported the CryptoBilis thefts on Oct. 11.
The company also tried to put a fence around Europe. On Oct. 14, Ledger said its Donjon security team had inspected devices from retail and distributor stock across Germany, "including units from the stores named," after reports from one person there (source 2). "None showed any sign of tampering," it said, adding that "no loss of funds related to implants has been reported anywhere in Europe" (source 2).
From one reseller to seven markets
The scope is the change. Ledger's Oct. 11 update said all confirmed cases involved devices sold through CryptoBilis, and that CryptoBilis had stopped selling hardware wallets (source 4). Two days later Ledger asked every reseller and distributor in seven markets to suspend sales "while the investigation is ongoing," while repeating that "the only confirmed incidents remain contained to Southeast Asia" (source 1).
Ledger has not said why it widened the pull. Its Oct. 13 update says the investigation is trying "to determine who tampered with these devices and where in the distribution chain it happened" (source 1). On Oct. 14 it told one user that all confirmed losses "involve devices sold through a limited number of resellers," plural, and that it is "reviewing other reports" (source 5).
| Date (ET) | What Ledger said | Source |
|---|---|---|
| Oct. 11, 1:13 p.m. ET | All confirmed cases tied to CryptoBilis, which has stopped selling | 4 |
| Oct. 13, 2:39 a.m. ET | Implant reads the setup screen and sends the 24-word phrase over LTE; Ledger has not confirmed the number of victims or total lost | 3 |
| Oct. 13, 6:03 p.m. ET | Resellers in seven Asian markets asked to suspend sales and clear shelves | 1 |
| Oct. 14, 11:31 a.m. ET | Confirmed losses involve "a limited number of resellers" | 5 |
| Oct. 14, 1:06 p.m. ET | German retail and distributor stock inspected; no tampering found | 2 |
Table 1. Ledger's statements on the CryptoBilis investigation. Source: Ledger's official X account (sources 1–5), accessed Oct. 14, 2026.
How the implant works, by Ledger's account
The mechanism explains why the pull reaches the shelf. Ledger's Donjon says the implant "sits inside the enclosure and reads the data shown on the screen" (source 3). When the device displays its 24-word recovery phrase during setup, the implant's microcontroller decodes the words and "transmits them over LTE using a provisioned eSIM," Ledger said (source 3). Anyone holding those words can move the funds from any device.
Ledger says the implant "does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures" (source 3). That is why the attack needs a tampered unit in the buyer's hands before setup, and why the company keeps saying it has "no indication that Ledger's infrastructure, systems or services or direct sales channel have been compromised" (source 1).
The objection: one person's claims, and no total
The German reports are not verified either way. Ledger says it has "not yet been able to examine the devices shown online" and has asked their owner to send them to its security team (source 2). Its clean result covers the stock it inspected, not those devices.
Ledger also still gives no count. It said on Oct. 13 that it has "not confirmed the total number of affected users or the total value lost," and that figures circulating online come from third parties it has not fully verified (source 3). Le Coin's Oct. 11 piece cited one such third-party count, from the analytics firm Bitquery.
Ledger's advice has not changed. Buyers from CryptoBilis should not set up unused devices and should move funds to a new device with a new recovery phrase, Ledger says, and owners worried about any device can inspect it with Ledger's published hardware guide (sources 3, 5, 6).
The tell
The next fact will come from the Donjon's bench. Ledger said it will analyze the devices it receives and share findings on the German units if their owner sends them in (sources 2, 3). Its Oct. 13 update did not set a date for lifting the seven-market suspension (source 1).
Sources
- Ledger (@Ledger), "Incident Update - Oct 13th, 2026," Oct. 13, 2026, 6:03 p.m. ET: https://x.com/Ledger/status/2110129361382994076
- Ledger (@Ledger), "An update from @DonjonLedger regarding Germany," Oct. 14, 2026, 1:06 p.m. ET: https://x.com/Ledger/status/2110416915835338942
- Ledger (@Ledger), "Update from Ledger Donjon on the CryptoBilis investigation," Oct. 13, 2026, 2:39 a.m. ET: https://x.com/Ledger/status/2109896739985453358
- Ledger (@Ledger), "72 hour update on reseller CryptoBilis incident," Oct. 11, 2026, 1:13 p.m. ET: https://x.com/Ledger/status/2109331538072494364
- Ledger (@Ledger), reply on confirmed fund losses, Oct. 14, 2026, 11:31 a.m. ET: https://x.com/Ledger/status/2110393153056374824
- Ledger Support, "Check hardware integrity": https://support.ledger.com/article/4404382029329-zd
Holding the Corner.
Not financial advice.