Ledger pauses wallet sales in 7 Asian countries and Germany, bans store displays after implant thefts

Ledger is changing how its hardware wallets are sold. After a wave of thefts tied to tampered devices, the company has suspended Ledger wallet sales through authorized resellers in seven Southeast Asian countries, paused retail sales in Germany, and handed stores a strict new set of rules for handling its products, according to a report published Oct. 15 by crypto.news.

The changes follow what Ledger calls "a localized distribution attack." Criminals bought real Ledger devices, opened them, added a hidden implant that captured recovery phrases during setup, and pushed the doctored wallets back into the retail chain. For anyone who keeps crypto on a hardware wallet, this is a reminder that where you buy the device matters as much as the device itself.

What Ledger changed in its wallet sales

According to crypto.news, Ledger suspended sales by authorized resellers in Hong Kong, Indonesia, Singapore, Thailand, the Philippines, Vietnam and Malaysia. It also suspended retail sales in Germany while the investigation continues.

The company introduced three rules for retailers that take effect right away:

• No more display units. Stores must stop putting devices on shelves. Wallets should be kept in storage and handed over only when a customer buys one.
• No resale of returns. A returned Ledger cannot be sold again, even if it looks unused and the packaging seems intact.
• Report anything odd. Retailers must quickly tell Ledger about unusual or suspicious hardware.

Ledger also said it inspected devices from stores in several markets, including Germany, plus warehouse samples and part of its own inventory. It found no unauthorized components in those samples, crypto.news reported, although the company did not say how many devices it checked.

Ledger said it is building new protections against physical tampering and plans to share what it learned with other wallet makers and sellers. It has not released technical details, the models involved or a timeline.

How the implant worked

Ledger's internal security team, known as Donjon, analyzed the attack. Bitcoin.com News, citing Ledger's findings, described a small device hidden inside the wallet's enclosure. When a new wallet is set up, it shows the user a 24 word recovery phrase on screen. The implant watched for those screens, decoded the words with its own microcontroller and sent them out over an LTE cellular connection using a built in eSIM.

That design is clever and unsettling. Ledger says the implant did not touch the Secure Element chip or the wallet's operating system, and it did not change transactions or signatures. It simply sat beside the real hardware and copied the one secret that controls everything. Once an attacker has your recovery phrase, they can rebuild your wallet on any device and move the funds.

Ledger said the group behind the attack spent months preparing and "millions" overall, according to crypto.news. The company has not named suspects.

The thefts and the retailer fallout

The problem first surfaced on Oct. 9, when users began reporting drained wallets. Those losses were linked to devices sold by CryptoBilis, a reseller in Southeast Asia. We covered the early reports in our story on the Ledger CryptoBilis hack.

Loss estimates have climbed since then. Bitcoin.com News reported that early projections of about $86 million later rose to about $93 million. Ledger has been careful not to endorse either figure. "We have not confirmed the total number of affected users or the total value lost," the company said, according to Bitcoin.com News.

Then the issue spread to Europe. Cointelegraph reported that a user on X claimed he bought two Ledger wallets from separate MediaMarkt stores and found unauthorized cables and cellular modules inside both. Former Mt. Gox CEO Mark Karpelès also said a Ledger Flex bought at Singapore's airport contained a spy implant, according to Cointelegraph.

MediaMarktSaturn, the parent company of MediaMarkt and Saturn, pulled Ledger products from its stores and websites. A spokesperson told Cointelegraph the products were removed "from our product lineup internationally in all of our countries" as a precaution. Ledger said the retailer acted in coordination with it after one customer in Germany reported an implant, and that no loss of funds was reported in that case.

Rival Trezor also said it was reducing its reseller partners amid supply chain concerns, Bitcoin.com News reported.

Why this matters for crypto holders

Hardware wallets exist to keep your private keys away from internet connected computers and phones. If you want a refresher on why that matters, our guide to how crypto wallets work explains the basics.

This attack did not break that model in the usual way. It did not hack Ledger's servers or crack its chip. Instead it attacked the supply chain, the long path a device takes from factory to your hands. Every reseller, warehouse and store shelf along that path is a chance for someone to tamper with the box.

That is why Ledger's new rules focus on handling, not code. Display units can be swapped. Returned devices can be opened and resealed. Removing those openings makes it much harder to slip a modified wallet back into circulation.

It also shows that security now depends on physical habits as much as digital ones. Earlier this month an Ethereum researcher urged users to adopt a crypto bunker mode because of new threats to wallet keys. The Ledger case points to a far simpler risk: a tampered box on a store shelf.

What to do if you own a Ledger

Here is practical guidance based on what Ledger has said publicly.

1. Check where you bought it. Ledger's warnings center on devices sold through CryptoBilis and other third party sellers. If you bought from CryptoBilis, Ledger says to take precautions right away.
2. Do not set up a suspect device. Bitcoin.com News reported that Ledger told customers not to activate unused devices from affected sellers.
3. Move funds with a new phrase. If your wallet may be affected, move your crypto to a trusted device using a newly generated recovery phrase, crypto.news reported. Restoring your old phrase on a new device does not help, because attackers may already have it.
4. Buy direct when you can. Purchasing from the manufacturer cuts out the extra hands in the chain.
5. Ignore anyone asking for your phrase. Ledger said its employees will never ask for your recovery phrase by message, call or website. Expect scammers to exploit this news, and review our tips on how to spot a crypto scam.

What to watch next

Several questions remain open. Ledger has not confirmed the full number of victims or the final loss figure. It has not said when sales will resume in the suspended markets or in Germany. Crypto.news reported that the company worked with SEAL 911 and law enforcement, but there is no word yet on arrests, charges or recovered funds.

The tamper protections Ledger promised will also be worth watching. If they involve new packaging seals, device checks at setup or changes to the hardware itself, they could become a model for the rest of the industry. Follow our crypto coverage for updates.

Frequently asked questions

Why did Ledger suspend wallet sales?

Ledger paused sales in seven Southeast Asian countries and in German retail stores after criminals sold tampered devices that stole recovery phrases during setup. The company says the pause is a precaution while it investigates.

Was Ledger itself hacked?

Ledger says no. It called the incident a localized distribution attack and said its manufacturing systems, infrastructure and Secure Element chip were not compromised. The implant was a separate component added after manufacturing.

How much crypto was stolen?

Independent estimates range from about $86 million to about $93 million, according to crypto.news and Bitcoin.com News. Ledger says it has not verified the total.

Is it safe to buy a Ledger now?

Buying directly from Ledger avoids most of the supply chain risk. Whatever you buy, always generate a fresh recovery phrase on the device and never use a phrase that came printed or preloaded.