Ledger review: Southeast Asia reseller tampering leads to estimated $90M losses

Ledger review of the October 2026 incident shows that an organized criminal group inserted hidden implants into genuine Ledger hardware wallets after they left the factory. The implants captured the 24-word recovery phrase during setup and transmitted it over LTE. Funds from affected wallets were then drained on-chain.

Reports of drained wallets surfaced on October 9. Ledger confirmed the presence of an implant on October 10 and asked authorized resellers in seven markets to halt sales on October 13. The company published its official response on October 15, stating that its chips, firmware, and direct sales channels remained uncompromised.

Ledger reseller security and the distribution chain attack

The attack targeted the post-factory supply chain. Attackers purchased authentic devices, installed custom implants designed to fit inside the enclosure without triggering the Genuine Check test, and returned the units through authorized channels. The Secure Element stayed untouched, allowing the devices to pass Ledger’s standard authenticity verification.

Confirmed cases centered on Malaysian reseller CryptoBilis, which serves customers in Indonesia, Malaysia, Philippines, Singapore, Thailand, Vietnam, and Hong Kong. Isolated reports also appeared at Singapore airport shops and one German retailer. Ledger has stated that all traced losses connect to devices purchased through this reseller network.

Independent analysts at Galaxy Research, Specter, and Bitquery traced transactions linked to hundreds of compromised wallets. Estimated losses range between $72 million and $102 million, with most reports citing figures near $86 million to $93 million across Bitcoin, Ethereum, and TRON/USDT holdings. Ledger has not issued an official total.

Is Ledger safe and steps to reduce Ledger hardware wallet risks

Users who purchased devices from CryptoBilis in the preceding 90 days should avoid initializing new units or restoring existing seeds on them. Funds already on such devices should be moved immediately to a fresh wallet created on an unaffected device.

Ledger recommends buying only from its official online store or verified authorized sellers. Buyers should inspect packaging, run the Genuine Check procedure, and contact support if any anomaly appears. The company continues to review reseller controls and anti-tampering measures.

Market comparisons show that competitors such as Trezor responded by reducing their own reseller networks in the same region. No arrests have been reported as of October 20, 2026, and Ledger states that confirmed incidents remain limited to Southeast Asia.

Investigation by Ledger’s Donjon team continues on returned devices. Further hardware or policy changes may follow once the tampering location and actors are identified.