Ledger has widened its response to the hardware implants found in its crypto wallets. It is now asking resellers and distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong to halt sales and pull stock while it investigates. This follows our earlier report on devices sold by the reseller CryptoBilis, which Ledger’s Donjon security team says contained a microcontroller that decodes the 24-word recovery phrase and sends it over LTE using a provisioned eSIM. The implant is a separate component that does not alter the Secure Element, Ledger’s operating system or transaction signing, so the device’s own integrity self-checks cannot detect it.
Ledger says all confirmed fund losses involve CryptoBilis devices, but users have reported compromised units bought elsewhere in Asia and Europe, including from a retailer at a Singapore airport and via MediaMarkt, which has since pulled the product from its shelves. Ledger says its own infrastructure, services and direct sales channel are safe. Separately, rival Trezor said it found no evidence its devices were compromised but will shrink its reseller network, ending partnerships on January 1, 2027 and tightening checks on how devices are sourced and handled.
How to check if you’re affected
Affected products are Ledger hardware wallets bought from CryptoBilis or other third-party resellers, especially in Southeast Asia and Hong Kong, and units reported from airport and consumer-electronics retail in Singapore and Europe. Because the implant is invisible to Ledger’s integrity self-checks, a clean on-device check does not prove a unit is genuine; the source of purchase is the reliable signal.
- If you bought a Ledger from any channel other than Ledger’s own store or an authorized reseller, treat it as suspect.
- If the device holds funds and came from an affected channel, follow Ledger’s earlier guidance: set up a new Ledger signer with a new seed phrase, move the assets, and do not reuse the old phrase.
- If you have not set up the device yet, do not start.
- Going forward, buy directly from Ledger.