Ledger has widened its response to the hardware-implant case: it has asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and take its devices off shelves while it investigates, according to BleepingComputer, and on 15 October it published new retail rules, reported by crypto.news. MediaMarkt Saturn has stopped selling the devices in Germany, and rival Trezor said it will end authorisation for some of its own resellers on 1 January 2027. Bitcoin traded near $81,660 at 06:04 UTC on Sunday 18 October on the Coinbase ticker, little changed on the week’s news.
This update covers what has changed since our earlier reports (11 October and 14 October), which described the implant itself. Here we focus on the sales channel, because that is where buyers can now act.
Timeline
| Date (2026) | Event | Source |
|---|---|---|
| 9 Oct | Ledger starts investigating after users report losses; later confirms CryptoBilis devices were tampered with | BleepingComputer |
| 13 Oct | Ledger’s Donjon team publishes technical details of the implant; Trezor letter says some reseller deals end 1 Jan 2027 | BleepingComputer; Blockhead |
| 14 Oct | Ledger asks resellers across seven Asian markets to halt sales | BleepingComputer |
| 15 Oct | Ledger publishes new retail rules and an update on samples inspected | crypto.news |
| By 15 Oct | MediaMarkt Saturn stops selling Ledger devices in German stores and online | crypto.news; Blockhead |
What Ledger asked retailers to do
According to crypto.news, Ledger’s 15 October rules say retailers must stop displaying wallets on shelves and counters and keep products in storage, handing them over only at the point of purchase. Returned devices must never be resold, even if they look unopened; Ledger says this rule already existed but must now be followed without exceptions. Retailers must also report customer complaints about unusual or suspicious hardware promptly. The earlier halt in Southeast Asia applied only to CryptoBilis, the reseller Ledger has linked to every confirmed fund loss so far; it has now been widened to authorised sellers in seven markets, Blockhead reports.
Germany: MediaMarkt steps back
MediaMarkt Saturn stopped selling Ledger devices in its German stores and online with Ledger’s agreement after a customer reported a suspected implant, according to Blockhead and crypto.news. Ledger said there was no confirmed loss of customer funds in the German case. BleepingComputer adds that MediaMarkt sources Ledger devices from the distributor Aqipa GmbH and took the products off its shelves. Ledger’s 15 October update said devices bought from stores in several markets, including Germany, showed no unauthorised components in the samples it inspected; it did not say how many devices were examined, so the finding is limited. A second reported case, a Ledger Flex bought at a Singapore airport retailer, Metapod, was documented in a teardown posted on 13 October by Mark Karpelès, who claimed it held an implant; Ledger has not confirmed a link to the earlier cases (Blockhead).
Trezor cuts its reseller network
Trezor announced on 13 October, in a letter to resellers, that it will reduce its reseller network, citing “recent supply-chain incidents”. Affected partners lose authorisation on 1 January 2027, receive no new stock and are removed from the authorised-sellers list, though they may sell existing inventory through the holiday season. Chief commercial officer Danny Sanders called it “a precautionary measure to protect our supply chain and our customers”. Trezor says there is no evidence its own devices were compromised, and remaining resellers will face stricter rules on sourcing, storage and handling (Blockhead; BleepingComputer).
The money and what is still unknown
Onchain investigator Specter has traced more than $86 million in suspected thefts linked to the incident; other researchers have put losses as high as $93 million. Ledger has not verified these figures. Ledger calls the event “a localized distribution attack” and says its infrastructure, operating system and security chips were not compromised; its Donjon team said the implant’s microcontroller reads the 24-word recovery phrase from the screen and transmits it over LTE using an eSIM, without altering the Secure Element. Ledger is still working out who tampered with the devices and at which point in the supply chain, and has said it will share findings with other hardware-wallet makers and sellers.
What buyers should do now
Ledger’s guidance for people who bought from CryptoBilis is not to initialise the device and to contact official support first. Anyone with a potentially affected device should move funds to a trusted device with a newly generated recovery phrase, because restoring the old phrase on a replacement would not protect coins if attackers already have it. Ledger also warns that its staff never ask for recovery words. Blockhead’s advice for buyers is to buy directly from the manufacturer and treat any device that shows signs of tampering, or arrives with a pre-set recovery phrase, as compromised.
For a step-by-step method, see our Field Guide #55, which gives eight checks for confirming a hardware wallet has not been tampered with. The central one is simple: a device should never arrive with a recovery phrase already written down or already set up, and you should generate your own phrase on first use.
What to watch next
Watch for Ledger’s findings on how the devices were altered and where in the chain; the number of devices inspected in its sample checks; whether more retailers in Europe or Asia pause sales; and whether other wallet makers follow Trezor in trimming reseller networks. The effective date to note is 1 January 2027 for Trezor’s reseller changes. Ledger has not given an end date for the Asian suspension, which BleepingComputer says runs until device-safety investigations are complete.
Method: bitcoin prices, highs, lows and closes are Coinbase Exchange candles (UTC day or UTC hour) pulled by Bitcoin Mastery at about 06:05 UTC on Sunday 18 October 2026; the 18 October candle is still open at that time, so any closing figure quoted is the 17 October close unless stated. Index, stock and yield figures are Yahoo Finance daily data or the news sources cited; other third-party figures are attributed to their source and date. Details come from BleepingComputer, crypto.news and Blockhead (links above), read on 18 October 2026; loss figures are onchain researchers’ estimates that Ledger has not verified.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.