Ledger Halts Reseller Sales Across Southeast Asia and Hong Kong

Ledger expands the reseller sales halt

The named markets are Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. Ledger’s request covers both resellers and distributors and explicitly includes removing products from shelves, rather than merely delaying new shipments.

The company did not announce an end date, a restart condition or a complete list of affected stock batches in the notice. It also did not quantify the number of participating outlets or devices held back from sale.

That leaves two separate questions: whether a seller is within the pause’s scope and whether a specific unit has been altered. Being included in the regional restriction does not, by itself, establish that a retailer supplied a compromised device.

Another retail action has occurred in Europe. MediaMarktSaturn told Cointelegraph that it removed Ledger products from physical and online sales internationally as a precaution. Ledger said the coordinated suspension followed an implant report from a customer in Germany, with no reported loss of funds in that case.

The German report therefore adds a distribution concern without establishing another confirmed theft location. Reports of suspicious hardware and verified wallet drains are different forms of evidence, and the company is still investigating their relationship.

Ledger’s Donjon security team will examine devices it receives, according to the regional notice. Establishing their handling history could help identify where legitimate inventory entered a compromised route, but the reviewed statements do not settle that question.

Bitquery counts 324 wallets in loss estimate

As of 09:06 UTC on October 14, Bitquery’s latest reviewed investigation estimated $102 million taken from 324 wallets across TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. Its latest dated update was October 13 at 10:00 UTC.

The loss total had last changed in the October 12, 14:00 UTC update, when Bitquery identified nine previously missed TRON wallets drained of 8.8 million USDT on October 9. That discovery revised accounting for the earlier attack; it did not establish a new October 12 theft wave.

Bitquery prices victim outflows at October 9 values and excludes subsequent swaps and transfers among attacker wallets. That methodology avoids counting the same stolen assets repeatedly as they move through different services.

Its count is of blockchain wallets, not necessarily 324 people or physical devices. One recovery phrase can control accounts on multiple chains, so the wallet tally cannot be converted directly into a customer count.

The firm also reported $10 million in USDT frozen by Tether across 20 holding wallets. A freeze restricts movement; it does not mean victims have received refunds. Two wallets Bitquery considers likely attacker-controlled held another 2.38 million USDC potentially subject to freezing.

Ledger’s October 13 Donjon update says the company has not confirmed the total affected-user count or value lost. The article therefore retains the analytics firm’s attribution rather than presenting its estimate as a verified company liability.

Similar distinctions shaped the Coldcard investigation’s later loss accounting. That earlier case does not establish a shared attacker or mechanism, but illustrates why device findings and on-chain loss estimates need separate verification.

Ledger explains the LTE implant and new-seed advice

Donjon says the separate implant reads screen data inside the device enclosure. During setup, it decodes the displayed 24-word recovery phrase and sends the words over LTE using a provisioned eSIM.

The company says the implant does not modify the Secure Element or Ledger operating system, and does not alter transactions or signatures. The disclosed attack concerns added physical hardware.

Ledger’s device-genuineness threat model explains that Genuine Check cannot detect an unauthorized physical addition when the original Secure Element remains intact. Authenticating that chip does not prove that nothing else has been installed beside it.

For CryptoBilis buyers, Ledger’s current instructions are more specific than waiting for a software update. Unused devices should not be initialized; customers who already set them up should promptly transfer assets to a new signer with a new recovery phrase.

Reusing the original phrase recreates the same keys. It cannot remove another person’s knowledge of them. Ledger also tells customers not to restore any recovery phrase on a CryptoBilis device or enter the words into a website, app or form.

Customers who lost funds should contact official support and local law enforcement, coordinating before opening or sending away a device. Preserving hardware can matter to the investigation; opening it can also damage it.

That guidance makes official contact channels consequential amid the disruption. Prior fake wallet-app scams illustrate a separate impersonation risk, without establishing those scams as the cause of this incident.

Alternative.me’s index read 62, classified as Greed, versus 57 a day earlier when checked at 09:06 UTC. It measures broader Bitcoin-market sentiment, not confidence in Ledger devices.

The next substantive updates are an affected-inventory definition, findings about where tampering occurred and conditions for resuming sales. The reviewed disclosures did not establish a reimbursement program, final device count or confirmed theft outside the previously identified reseller channel.