Ledger Asks Resellers in Seven Asian Markets to Pull Devices After Suspected $86M Drain

Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its devices while it investigates tampered wallets.

The company said the only confirmed incidents remain in Southeast Asia, and that it has not verified a drain linked to a device bought elsewhere.

MediaMarkt Saturn has stopped selling Ledger devices in its stores and online after a customer in Germany reported an implant, though no funds were lost.

Ledger has asked resellers and distributors in Southeast Asia and Hong Kong to stop selling its hardware wallets and take them off the shelves while it investigates devices fitted with a hidden implant, the company said in a tweet on Tuesday.

The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

The only confirmed incidents remain in Southeast Asia, Ledger said, and it has not verified a drain linked to a device bought elsewhere. The company has previously said that all confirmed losses involve devices sold through CryptoBilis, a reseller in the region.

Ledger is still working to establish who tampered with the devices and at what point in the distribution chain. It said it has no indication that its own infrastructure, systems, services or direct sales channel have been compromised.

Ledger's Donjon security team found that the implant reads the 24-word recovery phrase from the device's screen during setup and sends it out over LTE. Anyone holding that phrase can restore the wallet and move its funds. Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger says it has not verified.

Earlier on Tuesday, MediaMarkt Saturn stopped selling Ledger devices in its stores and online, with Ledger's agreement, after a customer in Germany reported an implant, Ledger said in a separate tweet. No loss of funds was reported.