Ledger asks Southeast Asia and Hong Kong resellers to halt sales

The regional sales request

Ledger asked resellers and distributors on 13 October to stop selling its devices in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. It also requested removal of products from shelves while investigators examine device tampering. For buyers, the immediate change concerns retail availability during the investigation.

Ledger says confirmed incidents remain confined to Southeast Asia and that it has not verified a wallet drain tied to a device bought elsewhere. Including Hong Kong in the sales request therefore does not establish a confirmed loss there. The company says its Donjon security team will examine received devices and directs customers to official support. It reports no indication that its infrastructure, systems, services or direct sales channel were compromised. The statement gives no restart date, loss total or general refund arrangement.

Checking the seller and the package

Ledger’s existing reseller guidance explains how its normal distribution channel works. An authorised reseller is a retail partner selected by Ledger to obtain stock through its official distribution chain. The company maintains a country and region list for checking those sellers, including when a purchase is made through a marketplace. A familiar shopping platform and an authorised seller are separate things to verify.

The documented process is to select the relevant country or region, identify the listed reseller, and use that reseller’s official store or website. This helps a buyer check who supplied the hardware, instead of treating a product listing or brand logo as sufficient evidence. It is background purchasing guidance, not confirmation that an individual device is untouched.

The guide also identifies unusually low prices, opened or resealed packaging, and recovery words already written on a supplied card as warning signs. For hardware that appears opened, altered or physically compromised, Ledger says not to use it and to contact support, even when the seller was authorised.

What Genuine Check can establish

A separate Ledger buying guide explains Genuine Check, the authentication test in its wallet software. The app sends a challenge to the device. The Secure Element, the protected security chip, answers with a digital signature created using a factory-installed secret key. The app checks that response against Ledger’s servers. This is intended to establish that the chip is authentic.

That result has a specific limit. Ledger says the test cannot detect an added physical component, including a spying implant, when the original Secure Element remains intact. A successful result therefore does not reconstruct everything that happened to the hardware between manufacture and delivery.

The same guide says the test should run through authentic software obtained from Ledger’s website or official mobile stores. Counterfeit software can falsely reassure buyers of fake hardware. These are explanations of the verification mechanism and its limits; they are not additional forensic findings about the devices under investigation.

Using support without exposing wallet credentials

Ledger’s phishing guidance explains why seeking help also requires care. Phishing means impersonating a trusted organisation to obtain secrets or induce a harmful action. A recovery phrase is the set of backup words that gives access to the accounts created from it. Ledger says neither its staff nor support team will ask for those words. They should never be supplied to a caller or typed into a website.

The company documents a deceptive sequence in which an attacker opens a support ticket using someone else’s email address. A real automated confirmation can then arrive before the attacker calls, making the call appear connected to legitimate support. The confirmation alone does not authenticate the caller. Ledger says it does not contact users by phone.

Its guidance also warns about social-media impersonators who request private messages or redirect people to another account. For an individual response, use the support channel reached through Ledger’s official website. A message demanding recovery words remains unsafe regardless of how convincingly it references a genuine security incident.