Where your device comes from
12 October 2026
Over the past few days a hardware wallet reseller in this region has been linked to Ledger devices that were opened, fitted with a hidden module and resealed before they reached the buyer. During setup the module read the recovery words off the device screen and sent them out over its own cellular connection. Researchers have traced roughly 311 emptied wallets and losses of between US$86 million and US$93 million, most of it drained inside an hour.
Ledger has confirmed that affected customer's device contained an unauthorised hardware implant. In its update on 12 October it said the number of affected devices is limited, that every confirmed case involves a device sold by that one reseller, and that its own systems and direct sales channel were not compromised.
Two details matter more than the amount.
The reseller was an authorised one. It had carried six brands for four years across three countries, and its founder was a recognised figure in the regional industry. Authorisation is not what failed. The company was sold in March this year and nothing about the storefront changed.
Ledger's own authenticity check did not catch it. That check verifies the secure element, and the secure element was genuine. The implant sat on the wiring between that chip and the screen, where display data travels unencrypted, which is not what the check looks at.
So the two answers this industry normally gives, buy from an authorised seller and run the built-in check, both failed at the same time. We are not going to repeat them to you as though they were enough.
If you bought a hardware wallet from the regional reseller in the last 90 days
Do not set it up, if you have not already. If you have, treat the recovery phrase as exposed. Move your funds now, to a device you have verified, using a newly generated phrase. Do not reuse the old words anywhere, on any device.
What we can tell you about our own stock
- Our units come directly from the official channel for each brand we carry. Nothing we have sold has passed through the reseller involved.
- We do not sell returned or opened units. A device that comes back to us does not go out again.
- Every order can be collected in person in Singapore and we can open the box together with you.
On the other brands
The reseller involved carried Trezor, Tangem, SafePal, OneKey and Ellipal alongside Ledger. That question is being asked openly and it deserves a straight answer rather than silence, so here is where it stands as of today.
No tampered device from any brand other than Ledger has been produced by anyone. Trezor says it is investigating, has had no reports of tampered Trezors from that reseller, and sees no indication its devices are affected. OneKey says it has had no reports of users losing funds, and has published five hardening changes including anti-counterfeit packaging and encrypted internal bus communication. Tangem has published its own note, and argues its card has no screen and no internal wiring for an implant to tap. SafePal responded on 10 October, pointing to three checks it says will flag a tampered or previously used device: an authentication step at first setup, an alert if the wallet has been activated before, and tamper-evident seals on the box.
Read that last one against the top of this statement. The devices in the Ledger cases arrived with their packaging apparently intact. Seals are worth checking, and they are not proof.
That is the evidence three days in. It is not the same thing as a clean bill of health for anyone, and we are not going to dress it up as one. If it changes we will say so here, including if it is inconvenient for us.