Ledger Orders Resellers in Seven Asian Markets to Pull Inventory

Ledger has instructed resellers and distributors across seven markets to halt sales immediately and pull existing hardware wallet inventory from shelves while investigating reports of physically tampered devices. The directive, issued via an official incident update on October 13, 2026, marks a significant escalation from the localized European reports covered in our earlier coverage.

The affected markets are Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. Stolen cryptocurrency linked to devices purchased through resellers in these regions triggered the investigation. The central concern: spy chips or other hardware modifications introduced somewhere in the regional distribution chain before the wallets reached end users.

"Ledger has told resellers and distributors in six Southeast Asian countries and Hong Kong to stop selling its hardware wallets and pull them from shelves while it investigates tampered devices."

Ledger, via official incident update, October 13, 2026

The geographic shift from Europe to Asia is the critical new development. Where the original reports pointed to a single compromised unit bought on the continent, the pattern now spans seven distinct markets across a densely populated region. That breadth implies either a shared distribution intermediary, a compromised regional logistics node, or a coordinated effort to target Asia-facing reseller channels specifically. Ledger has not publicly named a suspect vendor or warehouse.

Physical tampering at the reseller level differs fundamentally from the software-based 2023 Ledger Connect Kit compromise, which injected malicious code into a front-end library and drained wallets across multiple DeFi protocols. That attack was fast, remote, and scalable. A hardware implant requires physical access to individual devices, meaning either a rogue actor inside a distribution facility or counterfeit units substituted into legitimate packaging. Both scenarios are harder to execute at scale but also harder to detect before funds are lost.

Ledger's proactive halt limits additional exposure but leaves critical questions unanswered: how many devices are affected, what total value of cryptocurrency has been stolen, and how long the investigation will run. Users who purchased Ledger devices through official channels or directly from Ledger's website are not named as at-risk in the current advisory. The company's position is that reseller-level tampering falls outside its direct manufacturing controls, a defensible point technically, though it offers little comfort to users in the seven affected markets who may already hold compromised hardware.

Competing hardware wallet manufacturers, including Trezor and Coldcard, stand to benefit from any confidence gap during the investigation window. Trezor's open-source firmware model and Coldcard's air-gapped signing approach have historically attracted users skeptical of closed supply chains. Whether a meaningful portion of the Asian market rotates toward alternatives depends largely on how quickly and transparently Ledger publishes its forensic findings. A prolonged silence will cost more than a swift, detailed disclosure, even if that disclosure confirms significant losses.

The investigation timeline remains open. What is clear is that the supply chain attack surface for hardware wallets extends well beyond the factory floor, and seven markets being pulled simultaneously signals that Ledger's internal review has already found enough to act on, even if the public accounting is still incomplete.