Ledger has told its resellers to stop selling its hardware wallets in seven Asian markets after confirming that some of those devices were compromised and used to steal customers' crypto. The company says the incidents are confined to Southeast Asia and that there's no sign its own systems or direct sales channel were breached. The move affects third-party sellers, not Ledger's own online store or official retail partners.
Where the attacks happened
All the confirmed thefts trace back to devices sold through resellers in Southeast Asia. Ledger hasn't named the countries involved, but the seven markets where sales are now paused stretch across the region. The company describes these as isolated cases tied to a specific supply-chain gap, not a broad compromise of its manufacturing or software.
Hardware wallets like Ledger's are designed to keep private keys offline, so a compromised device undermines the entire point of buying one. Attackers who get access to a wallet before it reaches the customer can preload it with a seed phrase they control, then wait for the buyer to deposit funds. That's the pattern investigators are looking at here.
What Ledger says about its own channel
The company is adamant that its direct sales operation wasn't touched. According to Ledger, there's no indication that its systems were compromised or that devices shipped from its own warehouses are affected. That distinction matters because Ledger sells through both its website and a network of authorized resellers, and the pause only applies to the reseller side.
Even so, the company is asking customers in the affected markets to check where they bought their device. If it came from a reseller, Ledger wants them to verify the wallet's integrity before using it. The company hasn't said how many devices are involved or how much crypto was stolen.
Why resellers are the weak link
Reseller channels are harder to police than a company's own store. Devices can change hands multiple times before reaching a buyer, and each step is a chance for someone to tamper with the packaging or swap in a pre-configured wallet. Ledger's halt is effectively an admission that it can't guarantee the chain of custody once its products leave its authorized distribution network in these markets.
The company hasn't disclosed which resellers are affected or whether it plans to cut ties with them permanently. It also hasn't said when sales might resume or what conditions would have to be met first. For now, the pause is open-ended.
What customers should do
If you bought a Ledger from a third-party seller in Southeast Asia, the company's advice is straightforward: don't trust the device until you've checked it. Ledger has a verification process that involves connecting the wallet to its app and checking the firmware and seed phrase. A device that arrives with a pre-written seed phrase is a red flag — legitimate wallets never ship that way.
Customers who suspect their device was tampered with should move any funds to a new wallet immediately and contact Ledger support. The company hasn't announced a recall or a refund program for affected buyers, and it's not clear whether resellers will be on the hook for replacements.
What happens next
Ledger hasn't set a timeline for resuming reseller sales in the seven markets. The company says it's working with its distribution partners to figure out how the compromised devices entered the supply chain. Until that's resolved, buyers in the region who want a Ledger will have to order directly from the company — assuming its direct channel remains unaffected, which Ledger insists it is.
The bigger question is whether this spreads. Ledger's statement that the incidents are "confined to Southeast Asia" is a claim, not a guarantee, and the company hasn't explained how it drew that boundary. Customers outside the region who bought through resellers are left to wonder whether their own devices are safe.
