Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales and pull its hardware wallets from shelves while it investigates devices fitted with a hidden implant. The implant reads the 24-word recovery phrase during setup and sends it out over LTE, so anyone holding that phrase can move the wallet's funds. All confirmed losses involve devices sold through CryptoBilis, a regional reseller, and Ledger has not verified any drain linked to devices bought elsewhere, nor sees any indication its own systems were compromised. Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger has not verified. MediaMarkt Saturn stopped selling Ledger devices after a German customer reported an implant, though no funds were lost, and rival Trezor will end reseller authorizations on January 1, 2027 as a precaution.
Summary written by Upside AI from the original article. Read the source for full details.
Read the original on Decrypt ↗
Related news
- Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain
Ledger said its Donjon security team found an unauthorized hardware implant inside signers sold by Southeast Asian reseller CryptoBilis, which reads the 24-word recovery phrase from the screen during setup and sends it over LTE using a provisioned eSIM. Ledger confirmed the implant on one affected user's device on October 10th, and said all confirmed losses so far involve devices bought from CryptoBilis, which has stopped selling Ledger devices. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, but Ledger has not verified the number of affected users or total losses. The company told buyers who have not set up their device not to do so and to contact Ledger Support, while those who have should move assets to a new device with a new recovery phrase and report to police. Ledger is also reviewing reports of implants in other devices and locations.
- Ledger asks resellers to halt sales in Southeast Asia and Hong Kong
Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales and remove its hardware wallets from shelves while it investigates reports of tampered devices. The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, and expands an earlier request to reseller CryptoBilis. Ledger says the only confirmed incidents remain in Southeast Asia and it has not verified a drain linked to a device bought elsewhere, though users in Europe have reported suspected tampering in devices bought from retailers. The company says there is no indication that its infrastructure, systems or direct sales channel have been compromised.
- Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis
Ledger said every confirmed case in last week's wallet-draining incident involves devices sold through Southeast Asian reseller CryptoBilis, while its own systems and direct sales channels remain unaffected. The company described the number of affected devices as “limited,” said it is working with authorities, and noted that CryptoBilis has ceased all hardware wallet sales. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, and YFarmX sent Ledger a list of more than 450 drained wallets, though Ledger has not confirmed these figures or the cause. Separately, a user on X claimed to have found tampered Ledger devices in Europe and called for a recall, a claim that has not been independently verified. Ledger has told authorized resellers never to restock returned products and advised CryptoBilis buyers to move their funds to a new seed phrase on a device bought from Ledger.
- Trezor reduces resellers as a ‘preventative step’ amid Ledger tampering reports
Hardware wallet maker Trezor said it will reduce its number of resellers as a “preventive step” following reports that malicious implants were found in competitor Ledger’s devices. Chief commercial officer Danny Sanders said certain resellers will be removed from the authorized list on January 1 and will stop receiving Trezor shipments from Tuesday. Trezor said there is “not a single piece of evidence” that its own devices have been compromised, while Ledger confirmed that at least one device sold by reseller CryptoBilis in Southeast Asia contained an unauthorized implant that captured recovery phrases. Researchers estimate losses of between $72 million and $86 million, though Ledger has not confirmed the total number of affected users or value lost. CryptoBilis suspended all hardware wallet sales, and the parent company of MediaMarkt removed all Ledger products from its stores and online platforms.
- Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets
Trezor will end its reseller authorizations on January 1, 2027 and stop shipping new stock to them, calling it a precaution after supply-chain incidents and saying there is no evidence its devices were compromised. The move follows Ledger's Donjon team finding that wallets sold by Southeast Asian reseller CryptoBilis carried a spy implant that captures recovery phrases from the screen and sends them over LTE. Ledger told anyone who bought from CryptoBilis in the past 90 days not to set up their device, while onchain investigator Specter traced more than $86 million in suspected thefts, a figure Ledger says it has not verified. Trezor says CryptoBilis was already off its seller list and that it has received no reports of tampered devices from that retailer. Separately, a ShipMonk data exposure in August affected Trezor customers, with the total put at 80,689 in September, though Trezor says its devices, private keys and wallet backups were not affected.
- Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network
Ledger said a covert chip hidden in some hardware wallets sold by reseller CryptoBilis captured users' 24-word recovery phrases from the device screen and sent them to attackers over an LTE mobile network using an eSIM. The implant did not modify the secure element, the operating system, or any transactions and signatures, so Ledger describes it as a physical supply-chain attack rather than a breach of its software or systems. Ledger has confirmed one affected signer with an unauthorized implant and says all confirmed losses in the Oct. 9 incident involved CryptoBilis-sold devices, while it is still examining reports in other devices and locations. Onchain researchers estimated losses of up to $93.2 million across more than 300 wallets, and Tether froze $10 million of USDT tied to the theft. CryptoBilis has stopped selling Ledger signers, and customers who already used one should move assets to a device with a newly generated recovery phrase.
Related markets
Latest news
- One of this year's most important relationships in global financial markets is falling apart
One of the most important relationships in global markets has started to unravel over the past couple of weeks. Investors are scrambling to work out what it could mean for the economy and their portfolios.
- 2 High-Flying Dividend Stocks to Buy and Hold for a Decade
The article argues healthcare is rebounding in 2026, with Merck (MRK) shares up 39% and AbbVie (ABBV) up 24% year to date, versus about 12% for the S&P 500. Merck's second-quarter revenue rose 5% to $16.6 billion, beating estimates, with Keytruda sales of $8.4 billion, though Keytruda may lose patent exclusivity by 2028. AbbVie's second-quarter revenue grew 10.2% to nearly $17 billion and adjusted EPS rose 22.9% to $3.65, driven by Skyrizi and Rinvoq sales growing about 24%. AbbVie is on a streak of 54 consecutive annual dividend increases, including its time as part of Abbott Laboratories, qualifying it as a Dividend King. The author concludes both are attractive long-term holdings based on financial results, pipelines, and dividends.
- Nvidia (NVDA) Stock Price Lags Massive Earnings Growth—A Compelling Value Opportunity
Munro Partners' Munro Global Growth Fund posted a -12.6% net return in Q3 2026, trailing the MAET.ASX return of -13.8%, with long holdings the main detractors. The fund's letter named NVIDIA (NASDAQ:NVDA) its largest contributor, citing strong earnings growth and guidance for at least 70% revenue growth next fiscal year, versus consensus of 45%. Nvidia reported quarterly revenue of USD96.2bn in August, up 106% year on year, and management said growth would have been closer to 100% without supply constraints. As of October 12, 2026, NVDA closed at $214.13, down 4.23% over the past month and up 19.23% over the past year, with a $5.16 trillion market cap and a 52-week range of $164.27 to $243.37. The fund says demand for semiconductors and AI remains strong, creating a constructive setup as capex and political fears are now priced in.
- Better Artificial Intelligence Stock for 2026: C3.ai vs. SentinelOne
The article compares C3.ai, which sells enterprise AI applications, with SentinelOne, which provides AI-powered autonomous cybersecurity. In fiscal 2026 (ended April 30), C3.ai's revenue was nearly $250.3 million, down 35.7%, with a net loss of $470.4 million and negative free cash flow of $190.7 million. SentinelOne's fiscal 2026 (ended January 31) revenue reached $1.0 billion, up 21.9%, with a net loss of $450.7 million and free cash flow of about $75.9 million, though stock-based compensation equaled roughly 388.4% of operating cash flow. The article cites C3.ai's restructuring plan from February 2026 and long government sales cycles as risks, and SentinelOne's competition from larger vendors and reliance on Amazon hosting. It says SentinelOne trades at a lower valuation relative to sales, while C3.ai has no future earnings estimates.
- Salazar Resources to Begin Drilling the Yumi Gold-Silver Veins at Tarqui, with Porphyry Drilling Planned at Monja, Ecuador
Salazar Resources closed a $3,500,000 non-brokered private placement announced on October 8, 2026, and outlined its exploration plan. Phase 1 is about 1,500 metres of drilling in five holes at the Yumi gold-silver veins on its 100%-owned Tarqui project, with drilling expected to begin in late October 2026, and the veins have not previously been drilled. Selective rock-chip samples returned 105 g/t Au and 1,038 g/t Ag, and historical BHP holes intersected porphyry-style mineralization nearby, which the company interprets as lying on the periphery of a porphyry center not yet located. Phase 2 contemplates up to about 3,500 metres of drilling in four holes at the 100%-owned Monja copper-gold porphyry target from the first quarter of 2027, subject to surface access and permits. A soil survey of about 895 samples is also planned at Quimi, part of the Tarqui-Quimi project.
- Musk: AI’s Hard Part Is “Scaling Power”: 3 Stocks Uniquely Suited to Win This New Bottleneck Trade
Microsoft said it will scale its Maia chips to multi-gigawatt deployments starting next calendar year, and Elon Musk said scaling power is the hard part of AI. The article argues power is an input that chip and app companies cannot copy quickly, which favors Vistra (VST), Constellation Energy (CEG) and GE Vernova (GEV). Vistra has lost nearly a fifth of its value over the past year even though its adjusted EBITDA rose to $5.91 billion, while Constellation's normalized EPS is expected to reach $13.29 in fiscal 2027. GE Vernova's revenue is expected to reach $60.7 billion by fiscal 2028, and Jefferies has a $298 price target on Vistra. The article warns that all three stocks could move with the mood around AI, regardless of their results.
Get the briefing on Telegram or Zalo
Join the Upside Telegram channel or Zalo group for the Vietnam stocks and gold briefing at 8:00 and 19:00 (Vietnam time) on trading days, plus a weekly wrap on Saturday morning.