Investigation into Ledger Wallet Asset Leak... Sales Halted in Southeast Asia

Reports of asset loss from buyers of CryptoBilis... Amount of damage and number of affected wallets yet to be confirmed

Suspicions of malicious modules intercepting screen data... Investigation into actual damage and correlation

Recent recommendation to suspend purchases from the last 90 days... Sales and shipments halted in three Southeast Asian countries

[Block Media Reporter Lee Hye-yeon] Following reports of digital asset (cryptocurrency) losses from users who purchased devices through Ledger's official Southeast Asian distributor, Ledger has requested the company to halt sales and shipments and has initiated an investigation.

The industry is paying attention to the possibility of a supply chain attack where devices may have been tampered with during distribution, although the exact cause of the incident and the scale of the damage have yet to be confirmed.

Buyer Damage from Southeast Asian Resellers... Ledger Claims "No Breach of Our System"

Ledger's support account stated on October 9 (local time) via X that they are investigating reports of asset loss from Southeast Asian users who purchased products from CryptoBilis. CryptoBilis is registered as Ledger's official distributor in Malaysia, the Philippines, and Indonesia.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices....

--- Ledger Support (@Ledger_Support) October 9, 2026

According to Bloomberg, Ledger has confirmed that the damage reports it has received so far are related to products purchased from CryptoBilis. They stated that there have been no damage reports regarding products purchased directly from Ledger and explained to Cointelegraph that their infrastructure, systems, and services have not been compromised.

The estimated damage amount comes from on-chain investigators. Specter has traced suspicious addresses on the Bitcoin (BTC), Ethereum (ETH), and Tron (TRX) networks and estimates that the losses could exceed $86 million. However, it has not been verified whether all the traced funds are related to the losses of CryptoBilis buyers.

Cause Unconfirmed... Suspicions of Module for Recovery Phrase Theft

Supply chain attacks are being discussed as a possible cause of this incident. This involves tampering with internal components before the device is delivered to the buyer or making the attacker use a recovery phrase that they already know.

Mark Karpeles, former CEO of Mt. Gox, claimed to have found a malicious module inside a Ledger device obtained in Malaysia. Although the external packaging was not damaged, it was explained that a module equipped with LTE components, antennas, and eSIM was hidden behind the screen. However, it has not been confirmed whether the device was sold by CryptoBilis.

23pds, Chief Information Security Officer of SlowMist, analyzed that if the circuit board was modified as claimed, the recovery phrase could be read through the screen data line. This would involve collecting the words displayed on the screen during the initial setup and transmitting them externally via the mobile network.

This analysis focuses on the possibility that information transmitted through the screen was intercepted instead of directly extracting the private key from the security chip. However, this analysis is based on the premise of alleged device tampering, and further verification is needed regarding its correlation with the asset leak.

Changpeng Zhao, co-founder of Binance, also stated that it appears to be a supply chain attack related to a specific reseller based on publicly available information. Some users raised the possibility of purchasing counterfeit or tampered Ledger devices, but this is also not the final conclusion of Ledger's investigation.

Sales Halted for CryptoBilis... Recommendation for New Device and Recovery Phrase

Ledger has requested CryptoBilis to halt all sales and shipments of Ledger devices until the investigation results are released.

Users who purchased from the company in the last 90 days are advised not to start the initial setup if they have not yet done so. If they have already set it up, they are guided to consider transferring their assets to a new Ledger device that generates a new recovery phrase.

CryptoBilis also announced on the 10th that it has halted the sale and shipment of Ledger products through online channels and offline stores in Malaysia, the Philippines, and Indonesia, and temporarily closed some physical stores. This is explained as a measure to protect customers while investigations and expert reviews are ongoing.

Additionally, they informed that they would individually contact customers with undelivered orders to handle them. A recommendation was also made to affected users to preserve their devices and transaction history and report to the police, along with a reminder not to disclose their recovery phrases and PINs to others. Further updates will be announced within three business days.

Ledger clarified that the sales halt is targeted at the distribution channel of CryptoBilis and does not mean a complete halt of product sales worldwide.

Ledger stated that they will provide follow-up information as the investigation progresses. So far, the disclosed response includes the halt of sales and shipments through that sales channel and guidance for buyer protection. Additional security measures and prevention strategies will be specified once the attack method and damage scope are confirmed.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.