Ledger says criminals tampered with genuine devices before resale
Security & Exploits ·
Ledger has confirmed that an organized criminal group bought legitimate hardware wallets, fitted them with concealed components, and routed them back into the market through Southeast Asian resellers to steal recovery phrases and empty wallets.
In a public statement, the company described a months-long operation in which attackers acquired authentic units, opened the casings, installed custom hidden hardware meant to intercept recovery phrases during setup, and then pushed the altered devices back through distribution channels in South East Asia. Ledger said the group built its own supporting infrastructure, including servers to collect stolen seed phrases and systems to drain and launder funds, and described the effort as patient and well-funded, costing the attackers millions before a coordinated wave of thefts.
Ledger maintains that its chip, operating system, and servers were never breached, framing the incident as a compromise of the distribution channel rather than its internal systems. To verify this, the company says it ran its largest internal investigation to date, with its Donjon security lab dismantling a sample implant, while teams bought and opened devices from retail markets, including in Germany, and screened warehouse stock; all units examined in that process came back clean.
The episode has drawn attention beyond Ledger's own disclosure. An open-source investigation posted on karpeleslab.github.io and reporting from wublockchain.xyz both describe tampered units surfacing on regional retail platforms, including Lazada Thailand, Amazon Japan, Yahoo Flea Market Japan, and Ozon Russia, indicating the compromised stock reached buyers through multiple storefronts rather than a single outlet.
In response, Ledger has asked its Authorized Resellers and Distributors to pause sales in Southeast Asia and Hong Kong, and is working with law enforcement and security partners to trace stolen funds and unwind the attackers' infrastructure. The company is also tightening reseller rules, barring any resale of returned devices even if they appear new and unopened, requiring stock to be kept out of shelf displays and handed to buyers only at purchase, and mandating prompt reporting of any customer complaints about unusual units. Ledger said it intends to share further technical detail with the wider industry once its investigation permits.
What remains unclear is the total number of compromised devices in circulation, the scale of funds lost, and whether law enforcement action will identify or disrupt the group behind the operation. Ledger has said more disclosure will follow, but has not given a timeline for when a fuller technical account or final loss figures will be published.