Ledger Halts Reseller Sales Across Southeast Asia and Hong Kong After Tampered Wallets Found in Singapore Stores

Published October 14, 2026, 04:35 UTC. Based on Ledger's October 13, 2026 post on X, researcher Ben Yorke's October 13, 2026 post on X, and reporting by BitPinas, Cointelegraph, PANews and TokenPost.

Ledger has asked resellers and distributors across six Southeast Asian countries and Hong Kong to suspend sales of its hardware wallets and pull the devices from shelves while it investigates reports of tampered devices, the company said in an incident update posted on X on October 13.

The seven-market shelf pull

The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, according to the company's October 13 update, which said products should be taken off shelves until the investigation concludes. Ledger said its security team, Ledger Donjon, is analyzing physical devices it has received to determine who tampered with them and where in the distribution chain the interference happened. The company said it has no indication that its infrastructure, systems, services or direct sales channel have been compromised.

Confirmed cases stay in Southeast Asia, Ledger says

Ledger said the only confirmed fund-drain incidents remain contained to Southeast Asia and that it has not verified any drain linked to a device bought elsewhere. The regional freeze widens an earlier request that was aimed only at Southeast Asian distributor CryptoBilis, after the investigation became public on October 9 following reports of stolen crypto linked to devices bought through that reseller. Earlier teardown coverage by Ledger Donjon described hidden implants engineered to read recovery phrases and transmit them home over LTE.

Teardowns point beyond CryptoBilis

Independent teardowns reported by BitPinas suggest the tampering may not be limited to CryptoBilis. Security researcher Ben Yorke documented a Ledger Flex bought in late June from Metapod, a vendor at Singapore Changi Airport, that arrived in factory-sealed packaging and contained an LTE modem, eSIM module, custom antenna, auxiliary battery, ribbon cables and precision connectors tapped into the display circuitry, all fitted inside the original case. Former Mt. Gox CEO Mark Karpelès publicly examined units including one from Challenger, a major tech retailer at VivoCity in Singapore. Yorke wrote that the custom engineering showed the implants were not a one-off job. Ledger has attributed all confirmed wallet losses to CryptoBilis so far, with the Singapore retail teardowns still classified as suspected tampering rather than confirmed drains.

The $86 million backdrop

The freeze lands during the worst hardware supply-chain crisis in crypto history. Blockchain investigator Specter estimated more than $86 million in crypto may have been stolen from hundreds of wallets tied to devices bought through CryptoBilis, though the figure has not been independently confirmed. The fallout has already spread across the industry: OneKey cut ties with CryptoBilis and offered free replacement wallets, Trezor began ending reseller authorizations effective January 1, 2027, and European retailer MediaMarkt pulled Ledger products from stores after tampered devices surfaced in Germany.

This article is news reporting and is not investment advice.

Sources

• Ledger, post on X, October 13, 2026, primary source for the Southeast Asia and Hong Kong reseller sales suspension, the seven covered markets, the contained-to-Southeast-Asia statement and the Ledger Donjon device analysis
• Ben Yorke, post on X, October 13, 2026, primary source for the Ledger Flex teardown from Metapod at Singapore Changi Airport, the factory-sealed packaging and the LTE modem, eSIM and antenna implant components
• BitPinas, "Ledger Extends Regional Retail Freeze Across SEA and Hong Kong as Teardowns Find Spy Implants Beyond CryptoBilis" (October 14, 2026), secondary source for the seven-market scope, the Challenger at VivoCity and Metapod at Changi Airport teardown reports and the holder precautions
• Cointelegraph, "Ledger Urges Wallet Sales Halt in Asia Amid Tampering Probe" (October 13, 2026), secondary source for the reseller request, the six-country plus Hong Kong coverage and the CryptoBilis background
• PANews, "Ledger asks distributors in Southeast Asia and Hong Kong to suspend sales and remove devices from shelves" (October 14, 2026), secondary source for the Ledger X statement, the no-verified-drain-outside-Southeast-Asia statement and the distribution-chain investigation