Ledger has asked retailers and distributors across Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia and Hong Kong to stop selling its devices and clear stock from shelves. The October 14 request, posted on X, widens a freeze in sales that began with CryptoBilis. A crypto hardware wallet reseller.
Ledger's Donjon security team says a device linked to CryptoBilis had an implant that captured the 24-word recovery phrase from the screen during setup, then sent it out over a cellular connection. The attack didn't involve breaking into the Secure Element or tampering with the operating system or transaction signing. Instead, it targeted the recovery phrase itself, giving the attacker what they needed to access the wallets without having to get hold of the device.
Bitquery puts the losses at $93.2 million across 315 wallets on six networks, with around $70.5 million coming from TRON. The timeline shows the attacker funding addresses on September 25th and making dozens of test transactions before the actual draining began on October 9. Ledger hasn't confirmed Bitquery's total. Tether has frozen roughly $10 million in USDT, while about 2,990 ETH passed through Tornado Cash.
It's still not clear how many devices were affected. Former Mt. Gox CEO Mark Karpelès says a Ledger Flex he bought at Singapore Airport also appeared to contain an implant. That device came from Metapod, a retailer unrelated to CryptoBilis, and belonged to WOO's Ben Yorke. Yorke noticed unusual marks on it and sent it for inspection rather than using it. Ledger hasn't connected that device to the wallet drains. A researcher using the name Johannes has also reported finding a modified device bought from MediaMarkt in Europe, though that case remains unconfirmed too.
Who was actually behind the operation is another question yet to be resolved. CryptoBilis's former founders say they handed over operational control to new management in March, and reports point to share transfers in August. CZ claimed on X that the attackers bought the reseller and made the previous owners sign an NDA. So far, there's no verified evidence to support that claim. Trezor has removed CryptoBilis from its reseller network and says it hasn't found any tampered devices.
Ledger says neither its own systems nor its direct sales channel were compromised. It also says it hasn't verified a drained device purchased outside Southeast Asia. Until Donjon establishes whether the Flex and the European devices are connected to the same operation, the freeze across seven markets should be treated as a precaution. It doesn't tell us how far the attack actually spread.