Hardware wallet maker Ledger has asked resellers and distributors across seven Asian markets to suspend sales of its devices, as onchain investigator Specter traces more than $86 million in suspected thefts tied to tampered units sold through a regional reseller.

The company disclosed the pull request in a Tuesday tweet dated October 13, 2026. It covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong — six Southeast Asian jurisdictions plus the special administrative region. Ledger said in the same notice that the only confirmed incidents remain in Southeast Asia, and that it has not verified a drain linked to any device purchased elsewhere.

What does Ledger know about the implant?

Ledger's Donjon security team has reverse-engineered the malicious hardware. The implant reads the 24-word recovery phrase directly from the device's screen during setup and transmits it over LTE, according to the company's findings. Anyone holding that phrase can restore the wallet on another device and move the funds, which makes the attack effective against even a properly generated seed.

All confirmed losses so far trace to devices sold through CryptoBilis, a reseller in the region, Ledger has previously said. The company is still working to determine who fitted the implants and at what point in the distribution chain the tampering occurred. Ledger stressed it has "no indication that its own infrastructure, systems, services or direct sales channel" have been compromised.

How big is the suspected loss?

Specter, an onchain investigator, has linked more than $86 million in suspected thefts to the scheme. Ledger has not verified that figure, a caveat the company repeated in its Tuesday statement. That leaves a gap between the onchain trail and any official count, and it leaves victims, regulators and counterparties without a confirmed-loss number they can audit.

What are competitors and retailers doing?

Germany's MediaMarkt Saturn stopped selling Ledger devices in its stores and online on Tuesday after a customer in the country reported finding an implant, with Ledger's consent. No loss of funds was recorded in that case.

Rival hardware wallet maker Trezor responded by announcing it will end its authorizations for resellers on January 1, 2027. Trezor called the move a "precautionary measure" and said there is no evidence its own devices have been compromised. The shift would fold Trezor's distribution back into direct or tightly vetted channels just as Ledger wrestles with the same exposure on its side.

What happens next?

Ledger has not named a timeline for resuming sales in the seven affected markets. Its next deliverable is the chain-of-custody finding — where, and by whom, the devices were opened between factory shipment and CryptoBilis' shelves — and that answer will determine whether the pull becomes a regional pause or a permanent channel reset.

Trezor's January 1 cutoff gives resellers roughly eleven weeks to wind down. That deadline will redraw the competitive map: any Trezor distributor that wants to keep selling into 2027 must migrate to direct authorization, and any customer weighing a hardware wallet between now and the holidays will do it against a backdrop of two manufacturers openly rethinking how their hardware reaches shelves.