Ledger is investigating who tampered with its hardware wallets and where in the distribution chain it happened. It asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales and remove devices from shelves while its Donjon examines devices. Its earlier analysis found an implant in CryptoBilis-sold devices could read the 24-word recovery phrase shown during setup and transmit it over LTE, even if the device passes Genuine Check. Ledger says confirmed incidents remain in Southeast Asia, it has not verified a drain linked to a device bought elsewhere, and it has no indication its systems or direct sales channel were compromised. Ledger’s October 13 update · Ledger’s implant analysis