Ledger asks resellers in seven Asian markets to pull its wallets while it traces the tampering
Ledger asked resellers in seven Asian markets to pull its wallets from shelves on October 14. It has not tied a suspected implant in a Flex from a second reseller to the first cases, so how far the tampering reaches is open.
The Scientist · Science desk
What happened
- The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.
- Ledger's CryptoBilis investigation followed initial reports of more than $86 million in losses, and the company then confirmed an unauthorized implant in a device linked to that incident.
- The Flex belonged to Ben Yorke of WOO, who noticed suspicious marks and sent it to Mark Karpeles for a teardown instead of using it.
- Ledger said the confirmed incidents remain in Southeast Asia and that it has not verified a fund drain tied to a device bought elsewhere.
- Trezor separately announced changes to its reseller network after the Ledger incident, saying it had no evidence its own devices were compromised.
Why it matters
- constraint The suspension is a sales precaution and not a finding, so a buyer in any of the seven markets cannot tell from it whether a given unit is affected.
- contradiction Ledger says it has no indication its direct sales channel was compromised, while unverified social posts describe devices bought directly from Ledger; only the company's side comes with a statement.
- decision Both reported cases trace to third-party sellers, so for now the seller is the first thing a buyer in these markets can check before trusting a sealed box.
- exposure If Ledger Donjon links the Flex to the CryptoBilis device, a supplier upstream of both resellers becomes the suspect and the seven-market list may be too short.
The suspension is a response to uncertainty about location. Ledger described it as a precaution while investigators work out who altered the devices and where in the distribution chain it happened [5]. cryptotimes.io, which reported the update, adds that the request does not by itself establish that devices sold in all seven markets were compromised [8]. The reporting does not say how many units were altered or sold, so no market's exposure can be sized.
That leaves the Singapore Flex as the only evidence that the problem reaches past CryptoBilis. If confirmed, it would differ from the first case on both model and seller [16]. It is also one device, and the evidence so far is a teardown: Karpelès shared photographs and a walkthrough describing the suspected implant [19]. Ledger has not publicly confirmed a link to the earlier cases [12]. According to cryptotimes.io, the available reporting does not establish whether Metapod and CryptoBilis shared a supplier [15].
Ledger Donjon, the company's security team, is examining recovered devices [14]. Until it reports, the containment statement rests on the company's word. We'd treat the Flex as an open lead until then.
Karpelès's check of a rival product is the nearest thing to a control in the story, and it is thin. He said he found no implant in a Trezor Safe 7 bought directly from Trezor and had received no reports of similar tampering involving Trezor devices at that point [9]. That is one unit. cryptotimes.io notes that his comments are not a comprehensive audit of Trezor products and do not establish that other manufacturers' devices are unaffected [11].
What to watch
- Ledger Donjon's findings on the recovered devices, including whether the Singapore Flex implant matches the CryptoBilis one.
- Whether Ledger confirms or rules out a shared supplier behind Metapod and CryptoBilis.
- Whether the suspension widens past the seven markets or Ledger verifies a fund drain on a device bought elsewhere.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In an October 14 incident update, Ledger asked resellers and distributors across seven Asian markets to suspend sales and remove its devices from shelves while it examines where the hardware was altered.
- [2]
The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.
- [3]
The move extends an earlier sales suspension involving CryptoBilis, the reseller linked to the first confirmed cases.
- [4]
Ledger's investigation into CryptoBilis followed initial reports of more than $86 million in crypto losses, and the company subsequently confirmed an unauthorized hardware implant in a device linked to the CryptoBilis incident.
- [5]
Ledger described the regional suspension as a precaution while investigators work to establish who altered the devices and where in the distribution chain the tampering occurred.
- [6]
Ledger said the confirmed incidents remain contained to Southeast Asia and that it has not verified a fund drain linked to a device purchased elsewhere.
- [7]
Ledger said it had no indication that its infrastructure, systems, services or direct sales channel had been compromised.
- [8]
The regional suspension does not, by itself, establish that devices sold in all seven markets were compromised; it is a broader sales precaution while the investigation remains open.
- [9]
Asked about a Trezor Safe 7 purchased directly from Trezor, Karpelès said he had found no implant and had received no reports of similar tampering involving Trezor devices at that point.
- [10]
Trezor separately announced changes to its reseller network following the Ledger incident and said it had no evidence its own devices had been compromised.
- [11]
Karpelès's comments are limited to the devices and reports he described; they are not a comprehensive security audit of Trezor products and do not establish that all devices from other manufacturers are unaffected.
- [12]
Ledger has not publicly confirmed a connection between the Singapore device and the earlier cases.
- [13]
The device in the earlier reports was a Ledger Nano X; the Singapore device is a Ledger Flex, a different model.
- [14]
Ledger Donjon, Ledger's security team, is examining recovered devices as part of the investigation.
- [15]
The available reporting does not establish whether Metapod and CryptoBilis shared a supplier or whether the Singapore device is connected to the reported fund losses.
- [16]
If the Singapore Flex implant is confirmed, it would differ from the first reported case on two attributes: model (Flex versus Nano X) and seller (Metapod versus CryptoBilis).
- [17]
Unverified social media posts have described devices purchased directly from Ledger or used for years, as some Ledger users revisit older or unexplained cryptocurrency losses.
- [18]
Mark Karpelès, former Mt. Gox CEO, reported a suspected implant in a Ledger Flex purchased at Singapore Airport; he said it was bought from Metapod, not CryptoBilis.
- [19]
The Flex belonged to Ben Yorke of WOO, who reportedly noticed suspicious marks and sent it to Karpelès for inspection instead of using it; Karpelès shared photographs and a teardown walkthrough describing the suspected implant.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- cointelegraph.comLedger asks resellers to halt sales in Southeast Asia and Hong Kong
1 article · October 13, 2026
- cryptotimes.ioLedger Halts Sales in 7 Asian Markets as Tampered Flex Surfaces in Singapore
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Hardware Wallet SecurityFollow
- Supply-chain tamperingFollow
- Cryptocurrency TheftFollow