Исследование с проверкой источников: Bitget

What changed on 13–14 October

The incident began with one reseller. Ledger said all confirmed fund losses involve devices sold through CryptoBilis, a reseller in Malaysia, and that the implant it found reads the 24-word recovery phrase from the screen during setup and sends it out over LTE using a built-in eSIM. On-chain investigator Specter has traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, a figure Ledger says it has not verified.

What is new is the scale of the response. In a post on X on Tuesday, Ledger asked resellers and distributors across Southeast Asia and Hong Kong to suspend sales, "including taking products off the shelves", while the investigation continues. Decrypt and Protos both reported the list of markets, and Protos named the sellers affected by the request:

The full Protos list also includes N-Crypt, Pantrade, Dot Life, SiamBC, CK Artisans, GROOV, RTB, CryptoKing, Digibit, Fortress and OOOSH; it does not assign every one of them to a country, so the table only places the names whose market is clear from the sellers themselves.

Ledger says the only confirmed incidents are still in Southeast Asia and that it has no indication its own infrastructure, systems or direct sales channel have been compromised. The halt is about finding where in the distribution chain the devices were opened, not about a flaw in the chip that stores your keys: Ledger's security team says the implant is a separate component that does not modify the Secure Element or the device's operating system.

Europe is affected too. MediaMarkt Saturn, Europe's largest electronics chain, removed Ledger devices from its stores and website with Ledger's agreement after a customer in Germany reported an implant; no loss of funds was reported in that case. Rival maker Trezor, which says there is no evidence its own devices were compromised, told some of its resellers that their authorization ends on 1 January 2027 as a precaution.

What this means if you live in one of the seven markets

If you were about to buy a hardware wallet: do not buy one from a marketplace listing, a shop shelf or a reseller in these countries until Ledger lifts the request. The safest channel during the investigation is the manufacturer's own website. An order from the official store takes longer to arrive than a device on a shop shelf, but a few extra days is a small price compared with a wallet whose seed is copied the moment you write it down.

If you already own a Ledger bought from CryptoBilis: Ledger's instructions are direct. If it is still sealed, do not set it up and contact Ledger Support. If you already use it, move your assets promptly to a new device with a new recovery phrase, and never enter or restore any recovery phrase on the CryptoBilis device again. Report losses to local police, and do not open the device or post it to anyone before speaking to Ledger Support or the police.

If you own a Ledger bought from another reseller in these markets: Ledger has not verified any drain linked to a device bought elsewhere, but it is reviewing reports of implants in other devices and locations, and independent researchers have published photos of suspicious devices from more than one seller. The cautious step is the same one security teams give after any doubt about a seed: buy a replacement from the official store, set it up with a brand-new 24-word phrase, and move your coins there. Ledger has published a guide for inspecting the inside of a device, but it warns that opening it can damage it, so back up your phrase before you try.

If you bought directly from Ledger: nothing in the investigation so far points at the direct sales channel. Keep doing the basics: the recovery phrase lives on paper or metal, never in a photo, a cloud note or a chat.

How the implant gets your coins, in plain words

A hardware wallet shows your recovery phrase only once, during setup. The implant sits inside the case, watches the screen, recognises the phrase pages, decodes the words and sends them out over a mobile network. Whoever receives those words can rebuild your wallet on any device and move the funds, and nothing on the device itself looks wrong, which is why owners did not notice. A PIN, a passphrase you never typed while the implant was active, or a fresh phrase created on a clean device is what stands between you and that attacker.

Our exchange vs wallet guide explains when self-custody is worth the work and when it is not, and the scam red flags lesson covers the fake "support" calls that usually follow incidents like this. Ledger says it will never call you, message you first or ask for your recovery phrase.

Where to keep coins while you wait for a new device

An official-store order still has to be shipped to you, so there is a gap of days or weeks. If the old device is in doubt and you do not want your coins to sit behind a phrase that may have been copied, a temporary parking place on a large exchange with two-factor authentication and a withdrawal allowlist is a reasonable bridge for many people. Compare custody options on the Bitget profile before you move anything, and keep the exchange stage short.

Quick answers

Which countries did Ledger pause sales in? Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

Is it safe to buy a Ledger on Shopee, Lazada or Tokopedia right now? No. Ledger asked those sellers to stop; buy from the official store until it says otherwise.

Is my Ledger bought in Europe affected? Ledger has not verified a drain from a device bought outside Southeast Asia. MediaMarkt Saturn paused sales after one customer report with no funds lost.

Is the Ledger chip itself hacked? Ledger says no: the implant is an added part that copies the phrase from the screen, and it does not alter the Secure Element, the operating system, transactions or signatures.

Should I switch to Trezor? Trezor says it has no evidence of compromised devices and is cutting resellers as a precaution. The rule is the same for any brand: buy direct.

Our earlier explainer, Is my Ledger safe?, covers the first days of the CryptoBilis case.

What we could not verify

Ledger has not published the number of affected users or a confirmed loss figure, and it has not said when the sales halt will end. Claims of implants in devices from sellers other than CryptoBilis come from users and independent researchers; Ledger has said only that it is reviewing them.