BTC $83,371 
ETH $2,506 
USDT $0.9994 
BNB $743.34 
XRP $1.37 
USDC $0.9999 
SOL $107.41 
TRX $0.3272 
FIGR_HELOC $1.03 
ZEC $1,240 Ledger halts sales across Southeast Asia after device tampering
Hardware wallets have been found with physical spyware implants across multiple regions, leading to over $86 million in losses.
Key takeaways
- Massive losses reported. Users purchasing from CryptoBilis lost over $86 million after their devices contained spy implants.
- Geographic spread confirmed. Tampered devices have been identified across Asia, Europe, and South America, not just Southeast Asia.
- Seven countries affected. Ledger requested halted sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.
What happened
Ledger has requested resellers in seven jurisdictions stop selling its hardware wallets and remove devices from shelves while investigating tampering incidents. The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.
The investigation began after users of Malaysia-based reseller CryptoBilis reported missing funds linked to their purchased devices. Those users lost over $86 million after physical spyware implants were discovered inside their wallets.
Former Mt. Gox CEO Mark Karpelès identified the spyware method: implants inside devices designed to read screen output and record seed phrases while bypassing Ledger's Genuine Check security protocol. He helped confirm multiple cases of tampering across different device models.
Reports of tampered devices have extended beyond the initial Southeast Asian cases. Users in Europe and South America have also reported finding suspected spyware implants in devices purchased from official retailers.
Why it matters
Ledger confirmed its core infrastructure, systems, services and direct sales channels were not compromised. The company said it is investigating where in the distribution chain tampering occurred and who was responsible.
The incident highlights supply chain vulnerabilities in hardware wallet distribution. The discovery that resellers can modify devices before sale poses significant risks to customers who purchase from unofficial channels or retailers lacking proper verification procedures.
Background
CryptoBilis, the Malaysia-based reseller at the center of the initial losses, was acquired earlier this year and its former CEO has stepped down from operations. The company's ownership change raised questions about control and oversight during the transition period.
What is still unclear
- Whether all tampered devices across different regions originated from the same source or represent separate supply chain compromises remains unclear.
- The full scope of devices affected globally has not been disclosed, with Ledger noting only that confirmed incidents in Southeast Asia involved a limited number of devices.
Questions readers ask
How were the Ledger devices tampered with?
Physical spyware implants were placed inside devices to read screen output and record seed phrases while avoiding detection by Ledger's security checks. The tampering occurred within the distribution chain, not at Ledger's facilities.
Which countries are affected?
Ledger has halted sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. Tampered devices have also been reported in Europe and South America.
How much money was stolen?
Users who purchased from CryptoBilis lost over $86 million after their devices contained spy implants.
Is Ledger's company infrastructure compromised?
No. Ledger confirmed its systems, services and direct sales channels were not compromised. The company is investigating where in the reseller distribution chain the tampering occurred.
