Ledger has asked resellers and distributors in Thailand and six other Asian markets to pause sales while it investigates device tampering within the distribution chain. Here is what the October 13 incident update actually says, what remains unknown, and the practical steps customers in Thailand can take without assuming that every Ledger device is affected.
Key points
- Ledger has asked sellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove devices from shelves temporarily.
- Confirmed incidents remain contained to Southeast Asia, according to Ledger, with no verified wallet drain tied to a device bought elsewhere.
- The company is still investigating who altered the devices and where the tampering occurred in the distribution chain.
- Ledger says it has found no indication that its infrastructure, systems, services or direct sales channel were compromised.
- Customers should use official support channels and never disclose a PIN or 24-word recovery phrase.
What Ledger announced
In an incident update dated October 13, 2026 and posted the following morning in Thailand, Ledger said it had asked resellers and distributors in the named markets to stop selling Ledger devices and remove them from shelves while the investigation continues.
This is a supply-chain precaution, not a declaration that every Ledger device contains malicious hardware. Ledger also said it has no indication that its infrastructure, systems, services or direct sales channel have been compromised.
Incident Update - Oct 13th, 2026
— Ledger (@Ledger) October 14, 2026
Out of an abundance of caution, we have asked our resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices and take products off shelves while our investigation continues.
Markets covered by the notice
The notice names Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. Its wording applies to Ledger devices sold through resellers and distributors in those markets. It should not be expanded into a claim that all Ledger devices worldwide are affected.
Ledger says the confirmed incidents remain contained to Southeast Asia and that it has no verified case of funds being drained through a device purchased outside the region. The scope could still change as more devices and distribution records are examined.
Confirmed facts and open questions
| Issue | Current status |
|---|---|
| Sales in Thailand and named markets | Ledger has requested a temporary pause by resellers and distributors |
| Confirmed geographic scope | Currently contained to Southeast Asia, according to Ledger |
| Ledger's central systems | No indication that infrastructure, systems, services or direct sales were compromised |
| Who altered the devices | Still under investigation |
| Where tampering entered the supply chain | Still under investigation |
| Total number of affected devices | No final figure was provided in this update |
Why a temporary sales pause matters
The investigation concerns physical tampering somewhere between production and the customer, rather than only a remote software attack. Until investigators identify the point of compromise, a pause helps preserve devices and records, prevents suspect stock from reaching customers and makes batch-level tracing more reliable.
Ledger says its Donjon security research team will analyse devices, while Customer Support will provide guidance through official channels. Those technical findings will be more reliable than conclusions drawn from packaging photos or unverified social-media claims.
What customers in Thailand should do
If the device is still unopened
- Keep the box, seals, shipping label, receipt and order number intact.
- Do not disassemble the device yourself, as this may destroy evidence and affect warranty support.
- Ask the seller to verify the stock record and latest guidance before setup. If the source is uncertain, wait for official advice.
If the device has already been set up
- Never enter the recovery phrase into a website, form, chat or application sent by another person.
- Review where and when the device was purchased and note any unusual setup behaviour.
- If the seller has been named as affected, or the device behaves unexpectedly, contact Ledger Support and the seller immediately.
- If assets must be moved, create a new wallet on a trusted device with a newly generated recovery phrase. Do not restore the old phrase.
Ledger will not ask for a user's 24-word recovery phrase. Anyone offering inspection, reimbursement or urgent support in exchange for those words should be treated as a scammer.
SIAMBC's response
SIAMBC is following Ledger's latest notice and reviewing the relevant order, batch and inventory records. Once stock reaches SIAMBC, it is held in a locked area accessible only to a small number of authorised staff, with movements documented and devices kept sealed until fulfilment.
SIAMBC customers who have already purchased a Ledger device may contact the team with their order number for assistance checking the product record and current guidance. SIAMBC will never ask for a PIN or recovery phrase and will continue to rely on direct Ledger updates as the investigation develops.
Frequently asked questions
Does every Ledger user need to move funds?
No evidence currently supports a blanket instruction for every user. Consider the purchase source, stock record and any unusual behaviour. Customers who believe their device may be involved should contact their seller and Ledger Support for case-specific guidance.
Does passing Genuine Check guarantee that a device is safe?
Genuine Check is an important cryptographic verification of the Secure Element and firmware. Ledger has also explained that it is not designed to detect every possible physical addition, so provenance, physical condition and setup behaviour still matter.
Is Ledger's direct sales channel affected?
Ledger says it currently has no indication that its direct sales channel was compromised. Customers should continue monitoring official updates because the investigation remains open.
Sources
- Ledger: Incident Update, October 13, 2026
- The Block: investigation update
- CoinDesk: details of the examined device
This article reflects information available on October 14, 2026. The investigation remains active and details may change. Check Ledger's official notices and contact your seller before taking action involving a device or digital assets.
Share:
How to Check Whether a Hardware Wallet Is Genuine, Counterfeit, or Tampered With
Ledger Op3n 2026: Why Secure Hardware Matters After the CryptoBilis Incident