On October 13, 2026, Ledger asked retailers in six Southeast Asian countries and Hong Kong to temporarily suspend hardware wallet sales. The move followed the discovery of unauthorized electronic components capable of stealing recovery phrases and transmitting them to attackers over a mobile network.
The investigation began after reports of cryptocurrency theft from devices purchased through CryptoBilis. What makes this attack unusual is that Ledger's secure chip could remain intact while the device still passed its standard authenticity check.
Why Ledger Suspended Sales in Asia
On October 9, Ledger began investigating reports of funds disappearing from wallets sold through regional reseller CryptoBilis. The company asked the reseller to halt sales and shipments.
A technical examination by Ledger Donjon uncovered unauthorized electronic components inside some devices. On October 13, Ledger extended its precautionary measures to Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong.
Retailers were asked to remove the wallets from shelves pending further investigation. This was a temporary request from the manufacturer, not a government ban or confirmation that every device sold in these markets had been compromised.
Reports of suspicious wallets also emerged outside the region. In Germany, MediaMarktSaturn pulled Ledger products from sale after an unauthorized component was reportedly found inside a device.
Ledger said the confirmed thefts under investigation were still limited to Southeast Asia. Reports of stolen funds involving devices purchased elsewhere require separate verification.
How the Hardware Implant Worked
The attackers did not need to compromise the Secure Element, the protected chip Ledger uses to safeguard private keys.
Instead, they installed additional electronics inside the wallet's casing. Ledger Donjon researchers identified a microcontroller and a cellular communication module equipped with an eSIM.
During initial setup, a Ledger wallet displays a 24-word recovery phrase. The malicious module intercepted the data sent to the screen, captured the recovery words, and transmitted them over LTE.
With that phrase, an attacker could restore the wallet on another device and gain control of its funds without ever touching the original Ledger.
The compromised wallet could otherwise behave normally. Its owner could generate addresses, check balances, and approve transactions. The attack required no phishing website, fake application, or request to enter the recovery phrase on a computer.
The security breach occurred inside the very device the owner trusted to protect their keys.
Why Genuine Check Failed to Detect the Tampering
Genuine Check is Ledger's built-in authenticity verification system. It uses cryptography to confirm that a device contains a genuine Secure Element.
But verifying the Secure Element is not the same as verifying every electronic component inside the wallet.
If the original chip remains intact while an additional module intercepts screen data, Genuine Check can still pass.
That distinction separates cryptographic security from supply chain security.
Cryptographic protections are designed to prevent private keys from being extracted from the Secure Element. Supply chain security is meant to prevent physical tampering between manufacturing and delivery to the buyer.
Even sound cryptography cannot protect a recovery phrase if another component intercepts it during wallet setup.
How Widespread Is the Problem?
As of October 14, 2026, the full extent of the incident remains unknown.
Ledger has confirmed the discovery of unauthorized electronics in certain devices. However, the investigation has yet to establish where the tampering occurred in the supply chain or how many wallets may have been affected.
Some researchers have estimated losses in the tens of millions of dollars. Ledger has not confirmed a final loss figure or the total number of victims.
The company also stated that it had found no evidence of a breach affecting its own infrastructure, software services, or direct sales channel.
What has been confirmed is physical tampering with certain devices, not a widespread compromise of all Ledger wallets. Further cases cannot be ruled out while the investigation continues, but there is also no evidence that the manufacturer's entire product range is unsafe.
What Ledger Owners Should Do
If you purchased a device through CryptoBilis or another reseller involved in the investigation, the appropriate response depends on whether the wallet has already been used.
New, uninitialized wallet: Do not generate a recovery phrase or transfer funds to the device until the manufacturer provides further guidance.
Previously used wallet suspected of tampering: Assume the recovery phrase may have been exposed. The absence of unauthorized transactions does not prove that the phrase is still secure.
In that case:
- Set up a trusted device and generate an entirely new recovery phrase.
- Transfer any remaining assets to addresses controlled by the new wallet, verifying the receiving addresses on the trusted device.
- Stop using the old recovery phrase, even if the original Ledger has been reset or replaced.
- Follow updates through Ledger's official channels and avoid links in unsolicited security alerts or emails.
Changing the PIN, updating firmware, or restoring the old recovery phrase on another Ledger will not solve the problem. If an attacker has obtained those 24 words, they already have the information needed to access the funds.
Owners who purchased their devices through other channels do not automatically need to replace them. They should, however, verify where their wallets came from and follow developments in the investigation.
How to Reduce Crypto Storage Risks
Hardware wallets protect private keys against many software-based attacks, but their security also depends on where the hardware comes from.
Buying directly from the manufacturer reduces the number of intermediaries. For substantial crypto holdings, spreading assets across separate, independently secured wallets can provide another layer of protection.
There is an important distinction here: two Ledger devices using the same recovery phrase are effectively one wallet accessed through two devices. If that shared phrase is compromised, all funds controlled by it are exposed.
Independent storage requires separate recovery phrases. This limits the potential damage if one device or set of keys is compromised.
Crypto Resources: Separating Trading Access From Asset Storage
The same principle of limiting access applies to automated trading infrastructure.
Crypto Resources bybit trading bots connect to exchange accounts through API keys. Traders can use keys without withdrawal permissions, allowing the bots to operate without access to the recovery phrase protecting their long-term holdings.
Restricting withdrawal permissions limits what the trading application can access, but it does not eliminate potential losses from trades executed through the API.
Long-term reserves, exchange trading balances, and automation credentials are better kept separate. That way, compromising one part of the infrastructure does not necessarily expose every asset.
What to Watch as the Investigation Continues
Three questions will determine how serious the consequences of this incident become:
- Where in the supply chain were the devices modified, and which batches may have been affected?
- Will additional thefts be confirmed outside the original group of resellers?
- What new safeguards will Ledger introduce to detect unauthorized hardware implants?
Ledger has already announced a review of its supply chain controls and reseller procedures. The effectiveness of those measures will become clearer once the investigation's findings are released.
Conclusion
The Ledger incident has exposed a specific weakness in hardware wallet security: a genuine Secure Element and a successful Genuine Check do not rule out unauthorized electronics inside the device.
For wallet owners, the immediate concerns are where the device was purchased and whether its recovery phrase remains secure. If that phrase may have been intercepted, the appropriate response is to generate a new wallet with a fresh recovery phrase and move the funds.
Frequently Asked Questions
Has Ledger stopped selling hardware wallets altogether?
No. The company requested a temporary sales suspension in six Southeast Asian countries and Hong Kong. Individual retailers in other regions have also taken precautionary measures.
Was the Secure Element hacked?
The attack did not require compromising the secure chip. Additional electronics intercepted the recovery phrase as it was sent to the device's screen.
Can Genuine Check still be trusted?
Genuine Check verifies the authenticity of the Secure Element, but it cannot guarantee that no unauthorized components have been installed inside the casing. It remains a useful security check, within those limits.
Should I replace an older Ledger wallet?
The age of a device alone is not evidence of compromise. Additional precautions may be warranted if the wallet came from a suspicious source, shows signs of tampering, or belongs to a batch identified by the manufacturer.
What if my recovery phrase may have been stolen?
Generate a completely new recovery phrase on a trusted device and transfer your assets to new addresses. Do not reuse the original 24 words.
Risk Disclaimer
This article is for informational purposes only. A compromised recovery phrase can result in the complete loss of funds. Before transferring assets, independently verify the new device, receiving addresses, and private key storage arrangements.