Ledger has expanded its response to a hardware-tampering investigation, asking resellers and distributors across seven Asian markets to suspend sales and remove its devices from shelves while the company examines where the hardware was altered.
In an October 14 incident update, the hardware-wallet maker said the request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. The move extends an earlier sales suspension involving CryptoBilis, the reseller linked to the first confirmed cases.
The latest development also comes as former Mt. Gox CEO Mark Karpelès reports that a Ledger Flex purchased at Singapore Airport contained a suspected spy implant. The device was reportedly bought from Metapod rather than CryptoBilis, raising questions about whether the tampering is limited to one reseller or involves a wider distribution chain. Ledger has not publicly confirmed a connection between the Singapore device and the earlier cases.
Ledger Expands Its Sales Suspension
In its latest incident update, Ledger said it was asking resellers and distributors across Southeast Asia and Hong Kong to suspend sales while the investigation continues. The company specifically said the request includes taking products off shelves.
Ledger’s response follows its earlier investigation into CryptoBilis after initial reports of more than $86 million in crypto losses. The company subsequently confirmed an unauthorized hardware implant in a device linked to the CryptoBilis incident.
Ledger described the regional suspension as a precaution while investigators work to establish who altered the devices and where in the distribution chain the tampering occurred. The company also said the confirmed incidents remain contained to Southeast Asia and that it has not verified a fund drain linked to a device purchased elsewhere. It added that it had no indication its infrastructure, systems, services, or direct sales channel had been compromised.
Ledger’s security team, Ledger Donjon, is examining recovered devices as part of the investigation. The company has also directed affected customers to its support channel for assistance. The regional suspension does not, by itself, establish that devices sold in all seven markets were compromised. It is a broader sales precaution while the investigation remains open.
Karpelès Reports Tampered Ledger Flex at Singapore Airport
The investigation has taken on a new dimension after Karpelès reported finding a suspected implant in a Ledger Flex purchased at Singapore Airport. The device belonged to Ben Yorke of WOO, who reportedly noticed suspicious marks on the hardware and sent it to Karpelès for inspection rather than using it. Karpelès shared photographs and a teardown walkthrough describing the suspected implant.
The reported device differs from the Ledger Nano X involved in earlier reports. Its reported point of sale also differs: Karpelès said the Flex was purchased from Metapod at Singapore Airport, rather than from CryptoBilis. The development follows earlier reports of a hidden chip in a Ledger device examined by Karpelès. However, the available reporting does not establish whether Metapod and CryptoBilis shared a supplier or whether the Singapore device is connected to the reported fund losses.
Ledger has not independently confirmed that link. The finding should therefore be treated as a separate reported case pending further information from the company and its investigators.
Trezor Reports No Known Similar Cases
The Ledger reports have also prompted questions about whether other hardware-wallet brands are affected. When asked about a Trezor Safe 7 purchased directly from Trezor, Karpelès said he had found no implant and had received no reports of similar tampering involving Trezor devices at that point.
The development comes as Trezor has separately announced changes to its reseller network following the Ledger incident. The company said it had no evidence that its own devices had been compromised. Karpelès’s comments are limited to the devices and reports he described. They do not constitute a comprehensive security audit of Trezor products, nor do they establish that all devices from other manufacturers are unaffected.
Unverified Reports Add to User Concerns
The expanding investigation has also prompted some Ledger users to revisit older or unexplained cryptocurrency losses. Social media posts have described devices purchased directly from Ledger or used for years before funds were reportedly drained.
Those accounts have not been independently verified as connected to the current incident. A cryptocurrency loss can result from several causes, including phishing, exposure of a recovery phrase, malicious software, or other forms of wallet compromise. A report of missing funds alone does not establish that a device contained a hardware implant.
Ledger has said it has not verified fund losses linked to devices bought outside the confirmed cases. Until individual devices and transaction histories are examined, claims that the incident extends to all Ledger customers or direct purchases remain unsubstantiated.
The Singapore Flex report adds another point of sale to the investigation, but it does not establish the scale of any wider compromise. A separate report involving a European retailer has also raised questions about distribution channels. In that case, a researcher reported finding suspicious modifications in a Ledger device purchased in Europe, but Ledger had not confirmed a connection between that device and the CryptoBilis-linked fund drains.
How the Implant Works, According to Ledger
Ledger’s security research team has described how the implant found in a CryptoBilis-linked device could capture a recovery phrase without altering the wallet’s transaction-signing process. In its technical analysis, Ledger Donjon said the implant reads the 24-word recovery phrase displayed on the device’s screen during setup and transmits the information over a cellular connection. The company said the component did not modify the Secure Element, operating system or transaction-signing process.
The technical findings are detailed in The Crypto Times’ report on Ledger’s explanation of the CryptoBilis implant.
A recovery phrase can be used to recreate a wallet elsewhere. If an attacker obtains it, the attacker may be able to access the associated funds without physically possessing the original hardware wallet.
The widely circulated loss estimates, ranging from roughly $86 million to more than $92 million across hundreds of wallets, have not been fully verified by Ledger. The company has not confirmed a final loss total, and the relationship between all reported device findings and the fund drains remains under investigation.
What Ledger Users Should Know
The seven-market suspension signals that Ledger is taking the possibility of wider distribution-chain tampering seriously. The precise scope remains unresolved, however, and the company has not confirmed that every device sold through the affected markets was compromised.
Users who suspect their devices may have been tampered with should avoid setting up unused devices until they have obtained guidance from Ledger Support. Anyone who believes a recovery phrase may have been exposed should consider moving assets to a wallet generated with a new, secure recovery phrase, following trusted security guidance.
Additionally, users should never enter a recovery phrase into a website, app or online form, or share it with someone claiming to provide support. Buying from an authorized channel can reduce supply-chain uncertainty, but it does not eliminate every security risk.
Ledger’s investigation is now examining a broader regional distribution network, while the reported Singapore Flex remains a separate case whose connection to the CryptoBilis incidents has not been established. Further findings from Ledger Donjon will be important in determining where the devices were altered and whether the cases share a common source.
The Crypto Times has contacted Ledger and is awaiting a response.
