Ledger has asked resellers in six Southeast Asian countries and Hong Kong to pull its hardware wallets from shelves while it investigates tampered devices. The company announced the widened suspension request in a post on X on Tuesday, expanding an earlier halt tied to a single reseller, CryptoBilis.

The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. Devices should come off shelves while investigators work out where in the distribution chain the tampering occurred.

"To be clear, as the investigation continues, the only confirmed incidents remain contained to Southeast Asia. We have not verified a drain linked to a device bought elsewhere," Ledger said.

The probe became public on Oct. 9, after reports of stolen crypto linked to devices bought through CryptoBilis. Ledger had already asked that reseller to stop sales and shipments. Since then, users in other regions — including Europe — have reported suspected tampering in devices purchased from other retailers. Ledger says those reports remain unverified as drains.

Who tampered with the devices, and where?

That is the question driving the investigation. "The investigation is ongoing to determine who tampered with these devices and where in the distribution chain it happened," the company said.

Ledger has drawn one firm boundary around the problem. "We have no indication that Ledger's infrastructure, systems or services or direct sales channel have been compromised," it stated. In other words, the fault line sits between the factory and the shelf — not inside Ledger itself.

That distinction matters operationally. If tampering happened in transit or at a reseller warehouse, the fix is channel hygiene: tighter vetting, fewer intermediaries, sealed-chain logistics. Competitor Trezor has already moved that way, cutting its reseller roster as a "preventative step" amid the Ledger reports.

What does this change for hardware wallet buyers?

The practical read: a device bought through Ledger's direct channel carries no confirmed compromise. Anything acquired through a third-party reseller in the affected regions should be treated with caution until the investigation concludes. Users who bought from resellers elsewhere — Europe included — are watching reports pile up, though Ledger says no drain has been verified outside Southeast Asia.

For the industry, the episode exposes a structural weakness in the cold-storage pitch. The promise of a hardware wallet rests on an uncompromised device reaching the user's hands. A distribution chain with multiple intermediaries breaks that guarantee before the box is ever opened.

Why the channel, not the code, failed

Hardware wallets are only as trustworthy as their journey. Ledger's own systems, by its account, held. The devices were altered somewhere between manufacture and retail — a supply-chain attack on a physical product, not a software exploit.

The financial damage so far appears limited to Southeast Asia, and Ledger has not disclosed totals for the stolen crypto reported on Oct. 9. The reputational math is harder. Ledger sells security. A tampering scandal, even one contained to resellers, taxes the brand's core product.

Expect the company to answer the second question soon: who did it, and at which node in the chain. Until then, the sales suspension across seven markets stands as the operational firewall — and a signal that hardware wallet distribution is about to get a lot shorter.