Ledger has pulled devices from resellers in seven Asian markets and MediaMarkt Saturn has halted sales in Germany as the hardware wallet implant probe widens.
Updated 14 October 2026: Ledger has asked resellers in seven Asian markets to take its devices off the shelves, MediaMarkt Saturn has halted sales in Germany, and Trezor says it will end reseller authorizations on January 1.
Ledger has asked resellers and distributors in seven Asian markets to suspend sales of its hardware wallets and take them off the shelves while it investigates devices with implants hidden inside them. The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.
That is the widest pull so far. The probe began on Oct. 9 with a single reseller, CryptoBilis, and Ledger says the only confirmed incidents remain in Southeast Asia. It has not verified a drain linked to a device bought anywhere else.
European buyers have since reported suspected tampering in devices bought from retailers. One of those reports landed at MediaMarkt Saturn, which stopped selling Ledger devices in its stores and online, with Ledger's agreement, after a customer in Germany reported an implant. Ledger says no loss of funds was reported in that case. MediaMarktSaturn has removed the products from its lineup internationally in all of its countries as a precaution, a spokesperson said.
Ledger has not said when sales resume in the region, or when the investigation will finish.
Seven Markets and a Long List of Resellers
The suspension expands on Ledger's earlier request that CryptoBilis stop sales and shipments. The new list is long. LazMall, Shopee, N-Crypt, Tokopedia, Challenger, Metapod, Ishopchangi, Pantrade, Dot Life, JIB, B2S, SiamBC, Bitkub, GROOV, RTB, CryptoKing, BitcoinVN, Digibit, Fortress, HKTVMALL, CK Artisans, OOOSH and Crypto HK have all been named as affected.
Whether every one of them complies is not yet clear.
Ledger says the investigation is still working out who tampered with the devices and where in the distribution chain it happened. It says it has no indication that its own infrastructure, systems or direct sales channel were compromised, and that its Donjon security team will examine the devices it receives. It has also warned that many claims and figures circulating online are unverified.
Trezor Will End Reseller Authorizations Next Year
Trezor will end its authorizations for resellers on January 1, 2027. It calls the move a precautionary measure, and it has already stopped working with CryptoBilis.
Chief Commercial Officer Danny Sanders wrote that there is not a single piece of evidence that Trezor devices have been compromised, and said the company is cutting its list of authorized sellers to get better control over its supply chain.
That claim is disputed. Hardware hacker Joe Grand says he found implants in two Trezor devices and reported them to the company in August. One was a Model T bought through Facebook Marketplace in Canada in 2025. The other was a Trezor One from a TikTok shop, whose buyer became suspicious when about $50 left his account.
Grand's finding points at a different technique from the one used on the Ledger units. In both Trezor devices, the attackers had replaced the microcontroller, so the wallet generated one of a dozen or so pre-determined seed phrases the attackers had coded in, rather than a random one. Trezor says those examples likely refer to a case flagged in 2022, when unofficial sellers replaced the microcontroller itself instead of adding an implant to a genuine device. Grand says he wrote to Trezor about the Model T implant on August 10 and got a cordial response three days later.
The Ledger implants are the opposite shape. Nothing is replaced and nothing is rewritten, so the device still behaves like a genuine one, which is exactly why it is hard to spot.
OneKey is reviewing who sells its devices too. Its chief executive, Yishi Wang, said the change could cost the Hong Kong-based company an entire year's worth of revenue.
The European Devices and the Distributor Behind Them
The European claims come from an X user, Johannes. He said he bought two Ledger devices from separate MediaMarkt stores on Oct. 11 and 12, filmed an unboxing, and found the same extra cables and a cellular module in both. He has urged Ledger to recall the stock, saying the inventory could reach more than 1,000 stores across 11 countries, and said that as of the afternoon of Oct. 13 one store was still selling Ledger devices with staff unaware of the change.
Store records traced the MediaMarkt stock to Aqipa GmbH, a Europe-wide distributor, according to Johannes. Nobody has accused the distributor of wrongdoing. Whether Aqipa is the direct distributor between Ledger and MediaMarkt is not settled; Ledger's chief technology officer was unsure, per Johannes's account.
A second report came from outside Europe. Mark Karpeles, the former chief executive of the collapsed bitcoin exchange Mt. Gox, said he found a spy implant in a Ledger Flex bought at Singapore's Changi Airport. He later described the European units as an earlier generation of the implant and noted the antenna carried a marking reading "Eurasian version," pointing to region-specific variants tuned to local mobile frequencies.
None of the European claims has been independently confirmed. Ledger has not confirmed a tampered device outside CryptoBilis, has not named Aqipa, and has not said whether the German customer it referred to is Johannes.
Ledger Is Reviewing Its Reseller Controls
The distribution side is where Ledger's own answers have started. Chief technology officer Charles Guillemet said on X that the company is examining its anti-tamper measures and urged anyone who thinks their device may have been modified to check the company's inspection guidelines and mail suspect units back to Ledger.
Chief executive Pascal Gauthier said Ledger is assessing the controls that apply to its direct sales and to its reseller network, with the investigation still working out who tampered with the signers and where in the chain it happened.
The reseller at the centre has paused. CryptoBilis posted a notice on its website linking to Ledger's warning, saying it had stopped all sales and shipments of Ledger devices while the investigation runs and was cooperating fully. It had earlier widened its halt from Ledger devices to all hardware wallet brands across Malaysia, the Philippines and Indonesia, and temporarily closed its physical stores.
A rival is tightening up too. Trezor said it will reduce the number of resellers it works with so it can check them more effectively, after recent supply-chain incidents. CryptoBilis was already off Trezor's seller list. Trezor says the reduction is preventive and that it has no evidence its own devices were compromised.
Ledger's Guidance Leaves the Reimbursement Question Open
For owners who have already lost money, the question is who pays. Ledger's answer so far is procedural: contact its support team so the case can be included in the investigation, and file a police report. Its update did not address reimbursement.
The only free-replacement offer in the reporting so far comes from a rival. OneKey offered new devices to people who bought OneKey wallets from CryptoBilis, after ending the reseller's authorization. That covers hardware, not drained funds.
Ledger also has not confirmed how many users lost funds or the total value, which matters for any compensation discussion: nobody has an agreed figure to argue over yet.
How the Implant Read the Screen
The mechanism, as Ledger described it, is a small chain rather than a single break.
- The spy chip sat inside the device enclosure, hidden from the owner.
- During setup, the device screen displayed the recovery phrase, as it normally does.
- The implant's microcontroller recognized the displayed words and decoded them.
- It then transmitted them over LTE using a provisioned eSIM.
The secure element, the chip designed to protect private keys, was never attacked. That detail is why the device kept working normally, which is also what makes a tampered unit hard to notice in the hand.
A second account, from the researchers who examined the hardware itself, fills in the physical design. Tibane Labs, a crypto research and development studio, said the implant taps the signal path between the secure element and the OLED screen, reading the words pixel by pixel and sending them out over the cellular network. Mark Karpeles, who leads Karpeles Lab Inc. and is CTO at Shells.com, published a picture of the implant in a Ledger X and called it quite an evolution from earlier versions with manually soldered wires. Tibane confirmed his finding and said there were two implant versions for the Ledger X.
The two versions made room differently. In one, the attacker replaced the original battery with a smaller one that powers both the implant and the Ledger X, with an ST STM32G431KBU6 microcontroller under the battery and antenna, a 2x2 mm 8-pad eSIM next to it, and a shielded LTE module to send the words out. In the second, the board ran on the original battery and fit into the space normally taken by the foam padding under the OLED display. In that unit, markings on both the microcontroller and the eSIM had been scraped off to hide the part numbers. In both, the antenna wire was the telltale sign someone had been inside.
The most uncomfortable detail is where the board came from. One specimen used what Tibane described as a designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off.
The Check That Watches the Chip, Not the Case
One detail in Ledger's own support documentation explains why this is awkward for owners. Ledger provides a Genuine Check mechanism to confirm a device is authentic, but the page warns that it cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact.
The check guards the component, not the board around it. An attacker who leaves the secure element alone and adds hardware beside it stays outside the part of the product doing the verifying. Ledger has not identified the affected device models, and it has warned that because the implants leave the Secure Element intact, tampered devices may still pass its authenticity checks.
Ledger's support page does list a manual check for the Nano X: opening the device to confirm no extra chip has been added and that the microcontroller is an STM32WB55, on revisions 1 to 3, or an STM32WB35 on revision 4. It also notes that the device is accessible to users with technical experience, but that disassembly is not intended for routine maintenance.
The people who look at this hardware for a living are blunt about the limit. Hardware security researcher Joe Grand said ordinary crypto owners cannot realistically be expected to detect sophisticated tampering, because even technical people are not opening every device to check. Trezor's own spokesperson said intact packaging and a clean holographic seal are worth checking, but that those checks alone cannot guarantee a device has not been modified.
That gap is why the European claims matter even while unconfirmed. If a tampered unit passes the built-in test, the photos people post of opened devices become the main evidence, and so far those photos are disputed. Crypto analyst Mati Greenspan put the underlying problem simply: buying a hardware wallet introduces a whole chain of trust, from the manufacturer to the supplier to whoever handled the device before it reached you.
Loss Estimates Keep Diverging
Losses are still being counted, and the counts disagree. Ledger says it has not confirmed the total number of victims or the value stolen, and cautioned that figures circulating online came from third parties and are not fully verified.
We have not confirmed the total number of affected users or the total value lost.
- Bitquery counted $102 million taken from 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon, in an Oct. 12 update, saying that was more than first reported.
- On-chain researchers put the losses at up to $93.2 million across more than 300 wallets, with Tether freezing $10 million of USDT tied to the theft.
- Specter has traced more than $86 million in suspected thefts, a figure Ledger says it has not verified.
- Another tally puts suspected losses from tampered devices sold through CryptoBilis at up to $93.4 million.
- Galaxy Research's Alex Thorn estimated around $91 million as of Oct. 9.
- YFarmX reported $94.5 million from 521 addresses across seven blockchains, and later raised its own estimate to $103 million.
Each uses different address sets and methods, none counts the number of tampered devices, and none is verified by Ledger, so none is a headcount of affected owners. Bitquery adds two details worth knowing. Dozens of wallets signed the same request within seconds, after two weeks of test runs, which it says points to one thief holding all the keys. And the timing skews recent: victim wallets were first funded inside Ledger's 90-day window, and more than 8 in 10 were funded from June, so earlier buyers should check too.
On the recovery side, Tether froze $10 million in USDT across 20 wallets. Over four days, the thief put about 6,680 ETH into Tornado Cash, sent most of what came out on through Zcash, and swapped its USDD into ETH through THORChain, according to Bitquery. Two wallets likely the thief's still hold 2.38 million USDC that Circle can freeze.
What Ledger Is Telling Users Now
The guidance is short and specific, and it lives on Ledger's support page.
- Do not initialize unused devices. If a device is already set up, move to a new seed on a device from Ledger.
- Do not import or restore your existing recovery words into another device bought from CryptoBilis. Restoring a phrase that has already been exposed would not protect the funds.
- Do not send a suspected tampered device to anyone before consulting Ledger Support or the authorities. Ledger says victims should contact it and local law enforcement first.
- Ledger says its support staff will never call you, send unsolicited direct messages, or ask for your recovery phrase.
- Ledger told distributors to source products exclusively through authorized channels and prohibited the restocking of returned products. It says it believes the volume of impacted devices is limited.
Ledger's Donjon team said it will keep examining reports involving other signer models and locations. It has not said it has verified a theft involving a signer bought elsewhere, and it has not announced a date for completing the investigation or publishing a final report.
What remains open is the part owners would most like answered: how many devices were modified, at which point in the distribution chain, whether the implant accounts for all the reported losses, who covers them, and when sales resume in Germany and the seven Asian markets. Ledger has not said.
This episode is distinct from an April phishing campaign involving a fake Ledger Live app on Apple's App Store, which drained at least $9.5 million after users entered their recovery phrases. For scale, a July 2026 flaw in Coldcard's seed-generation firmware let attackers drain an estimated $100 million to $130 million in bitcoin.
Shashwat Gupta
Shashwat Gupta is an entrepreneur, CEO and co-founder of the online media portal, Altcoin Buzz. Shash has been a crypto enthusiast since 2015 and entered the emerging cryptocurrency space full time in early 2017. His business expertise and extensive knowledge in the crypto space have helped shape Altcoin Buzz to be what it is today.
More from ShashwatNext up
SOL Falls Below Its Last Dip, but Can the $92.50 Floor Hold?
SOL closed below its 15 September low of $95.82 on 29 October, ending its run of rising peaks and dips. It now sits on a floor at $92.50.