An update from @DonjonLedger regarding Germany 🔽
Following reports from one person in Germany, our team inspected devices from retail and distributor stock across the country, including units from the stores named. None showed any sign of tampering. No loss of funds related to implants has been reported anywhere in Europe.
We have not yet been able to examine the devices shown online. We invite their owner to send them to our security team so we can analyze them and share our findings.
Tomorrow at Ledger Op3n, we’ll unveil our latest announcements on securing what matters most in the age of AI, Tokenization, Quantum and share where the Ledger platform is headed next. At the top of the event, our CEO @_pgauthier will also directly address the incident in Southeast Asia from this weekend.
Here’s what to expect:
Update from Ledger Donjon on the CryptoBilis investigation 🔽
@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer. All confirmed fund losses tied to the incident disclosed on October 9th involve signers sold through CryptoBilis. We have not verified a drain linked to a signer bought elsewhere. CryptoBilis has confirmed it stopped selling Ledger signers while the investigation continues.
Based on the Donjon's analysis of the attack, the implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.
The Donjon will analyze the signers it receives and will share more as the investigation continues.
We have not confirmed the total number of affected users or the total value lost. Figures circulating online come from third parties and Ledger has not fully verified them. If your funds were drained and you have not contacted us, please do so through Ledger Support so we can include your case. We are also reviewing reports of implants in other signers and locations. We will continue to share information as the investigation progresses. Rest assured the Ledger team is going above and beyond to leave no stone unturned to investigate this situation to the strongest possible outcome.
If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase. Do not enter or restore any recovery phrase on a signer bought from CryptoBilis. Never enter your recovery phrase into a website, app or form.
If you lost funds or hold a tampered signer, contact Ledger Support at https://t.co/QzukOZdEzq and file a report with local law enforcement. Do not send the signer to anyone before speaking with Ledger Support or local law enforcement. If you lost funds, coordinate with law enforcement before opening the signer. Researchers and others with relevant information can write to [email protected].
If you did not buy from CryptoBilis and want to inspect the inside of your signer, the guide is at https://t.co/Bh9DHQulIv. Use caution and make sure your recovery phrase is backed up first, because opening a signer can damage it.
Ledger will never call you, message you directly, or ask for your 24-word recovery phrase. We will update this post when we verify new information.
Update on Ledger devices at MediaMarkt Saturn 🔽
As of Oct. 13th, MediaMarkt Saturn has stopped, with Ledger’s alignment, the sale of Ledger devices in their stores and online while the investigation continues, following the report of an implant from one customer in Germany. No loss of funds were reported.
We have no indication that Ledger's infrastructure, systems or services were compromised. Ledger Support is reviewing user reports, and Ledger’s cybersecurity experts, the Donjon will be examining the devices we receive: https://t.co/QzukOZdEzq.
If you have questions about a device you bought, contact Ledger Support at https://t.co/QzukOZdEzq. Ledger will never call you, message you directly or ask for your 24-word recovery phrase.
Many claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger and MediaMarkt Saturn channels for updates. We will share more as the investigation continues.
แจ้งระงับการจำหน่าย Ledger ชั่วคราว
Ledger ขอให้ตัวแทนจำหน่ายในเอเชียตะวันออกเฉียงใต้และฮ่องกง รวมถึงประเทศไทย ระงับการจำหน่ายเครื่อง Ledger ชั่วคราวระหว่างการสอบสวน SIAMBC ในฐานะตัวแทนจำหน่ายอย่างเป็นทางการ จึงขอระงับการจำหน่าย Ledger ทุกช่องทาง ทั้งหน้าร้าน เว็บไซต์ Shopee และ Lazada ตั้งแต่วันนี้ จนกว่าจะได้รับแจ้งจาก Ledger อีกครั้งครับ
มีคำถามเรื่องการสอบสวน ติดต่อ Ledger Support ได้ที่ https://t.co/EUDfBTgKnZ
ใครขอ Seed Phrase คือมิจฉาชีพ Ledger และ SIAMBC ไม่มีวันขอครับ
---
Ledger sales temporarily suspended
At Ledger's request to resellers in Southeast Asia and Hong Kong, including Thailand, SIAMBC as an official reseller has suspended Ledger sales on every channel (store, website, Shopee and Lazada) from today until Ledger advises otherwise.
For questions about the investigation, contact Ledger Support at https://t.co/EUDfBTgKnZ
Anyone asking for your Seed Phrase is a scammer. Ledger and SIAMBC will never ask.
#Ledger #SIAMBC
Incident Update - Oct 13th, 2026
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices while the investigation is ongoing. This includes taking products off the shelves.
Specifically the countries are: Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia, and Hong Kong.
To be clear, as the investigation continues, the only confirmed incidents remain contained to Southeast Asia. We have not verified a drain linked to a device bought elsewhere.
The investigation is ongoing to determine who tampered with these devices and where in the distribution chain it happened. The Ledger Donjon will analyze the devices it receives, and Ledger Customer Support will provide guidance to users who reach out through our official channel: https://t.co/QzukOZecoY.
We understand this is concerning, and will continue to provide updates from the Ledger Donjon as the investigation progresses. Stay vigilant.
We have no indication that Ledger's infrastructure, systems or services or direct sales channel have been compromised.
Update from Ledger Donjon on the CryptoBilis investigation 🔽
@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer. All confirmed fund losses tied to the incident disclosed on October 9th involve signers sold through CryptoBilis. We have not verified a drain linked to a signer bought elsewhere. CryptoBilis has confirmed it stopped selling Ledger signers while the investigation continues.
Based on the Donjon's analysis of the attack, the implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.
The Donjon will analyze the signers it receives and will share more as the investigation continues.
We have not confirmed the total number of affected users or the total value lost. Figures circulating online come from third parties and Ledger has not fully verified them. If your funds were drained and you have not contacted us, please do so through Ledger Support so we can include your case. We are also reviewing reports of implants in other signers and locations. We will continue to share information as the investigation progresses. Rest assured the Ledger team is going above and beyond to leave no stone unturned to investigate this situation to the strongest possible outcome.
If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase. Do not enter or restore any recovery phrase on a signer bought from CryptoBilis. Never enter your recovery phrase into a website, app or form.
If you lost funds or hold a tampered signer, contact Ledger Support at https://t.co/QzukOZdEzq and file a report with local law enforcement. Do not send the signer to anyone before speaking with Ledger Support or local law enforcement. If you lost funds, coordinate with law enforcement before opening the signer. Researchers and others with relevant information can write to [email protected].
If you did not buy from CryptoBilis and want to inspect the inside of your signer, the guide is at https://t.co/Bh9DHQulIv. Use caution and make sure your recovery phrase is backed up first, because opening a signer can damage it.
Ledger will never call you, message you directly, or ask for your 24-word recovery phrase. We will update this post when we verify new information.
The CryptoBilis investigation continues. This is a complex investigation, and as CEO, I am leading it with my Executive team. We are dedicating time and resources to explore every aspect to protect @Ledger users and find the malicious actors. Ledger and I will continue to communicate only facts we can validate through authorized channels.
All confirmed fund losses connected to the incident disclosed on October 9th involve Ledger signers sold through CryptoBilis, a reseller in Southeast Asia. On October 10th, Ledger confirmed that one affected signer contained an unauthorized hardware implant. We have no indication that Ledger's infrastructure, systems or services were compromised. CryptoBilis has confirmed it stopped selling Ledger signers. The investigation is ongoing to determine who tampered with these signers or where in the distribution chain it happened. The @DonjonLedger will be examining the signers we receive, and Ledger Support is reviewing user reports to establish this.
We are reaching out to affected users and working with law enforcement. If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase.
Do not send your signer to anyone before speaking with Ledger Support or local law enforcement, especially if you lost funds. Ledger will never call you, message you directly or ask for your 24-word recovery phrase.
Physical supply chain tampering is a risk for the whole industry. We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can. We are asking researchers and other vendors to work with us on chain-of-custody and tamper-detection practices. The Donjon's analysis is ongoing and will continue as we receive signers. Thank you to the users who contacted us through official channels.
Some claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates.