Ledger suspends Southeast Asian resellers during $90 million crypto wallet hack investigation

Ledger has asked resellers and distributors in seven markets to pause sales of its hardware wallets while it investigates reports that devices were tampered with somewhere in the distribution chain and later drained of crypto. For PSPs and merchants in high-risk verticals, the important bit is not the hack itself but the supply-chain angle: the direct sales channel is not the issue here, third-party distribution is.

1. Ledger said in a Tuesday, Oct. 13 post on X that its request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. The company said it has confirmed incidents only in Southeast Asia and has not verified any incidents linked to devices elsewhere.
2. “We have no indication that Ledger’s infrastructure, systems or services or direct sales channel have been compromised,” the company said. Ledger also said it would continue to provide updates from the Ledger Donjon, its security research team, as the investigation progresses.
3. Bloomberg reported Tuesday that spyware was implanted in some Ledger devices, allowing someone to steal $90 million in cryptocurrency. According to the report, users began reporting losses on Friday, Oct. 9, and some of the affected devices were purchased from Malaysian reseller CryptoBilis.
4. CryptoBilis said in an official notice shared on X that it paused all sales and shipments of Ledger devices after Ledger published its security notice, and that it is cooperating with the investigation. In a later update, it said it temporarily paused sales and shipments of all hardware wallets, of all brands, in Malaysia, the Philippines and Indonesia.
5. Ledger’s case is already pushing other hardware wallet makers to reassess reseller relationships. Bloomberg reported that OneKey and Trezor have said they are halting or reviewing some of their relationships with sellers; OneKey said it terminated CryptoBilis’s authorization as a reseller, stopped adding resellers and is reviewing existing ones.

For operators in crypto, forex, and other high-risk verticals, this is the kind of incident that tends to matter beyond the immediate headline: it puts third-party distribution, device custody, and reseller controls under the microscope, while leaving the vendor’s own infrastructure untouched, at least for now.