Ledger Says Organized Group Tampered With Hardware Wallets for Months

Company traces implant to Southeast Asian resale channels

Ledger said an organized criminal group spent months buying genuine hardware wallets, adding hidden components to steal recovery phrases, and returning the devices to resale channels in Southeast Asia.

In an Oct. 15 investigation update, the company said the attackers built servers and infrastructure to drain compromised wallets and launder the proceeds. Ledger said the group "spent millions" and carried out the operation in a coordinated manner.

A hardware wallet is a physical device used to store cryptocurrency offline, keeping private keys secure away from internet-connected computers.

New rules for authorized resellers

Ledger is now requiring its authorized sellers to keep devices off shelves and displays, holding stock in the back until a purchase is made. The company also reiterated an existing ban on reselling returned devices, even if they appear new and unopened.

These handling changes apply across Ledger's authorized reseller and distributor network. A previous sales suspension covered seven Asian markets.

What the implant does and does not touch

Ledger described the incident as a "localized distribution attack" that happened after devices left its control, rather than a compromise of its chip, operating system, or servers.

The company's Donjon security lab dismantled the implant and determined how it worked. According to Ledger's earlier technical account, the device reads the 24-word recovery phrase shown during setup and sends it over LTE using an eSIM.

A recovery phrase is a list of 24 words that can restore access to a cryptocurrency wallet. If a thief captures this phrase, they can move the funds without needing the original device.

Ledger said the added hardware leaves the Secure Element security chip and its operating system unchanged. This means Ledger's Genuine Check tool, which authenticates the Secure Element, cannot detect spying hardware when the original chip remains in place.

No total loss figures confirmed

Ledger has not confirmed the total number of affected users or the value lost. Its Oct. 13 statement said it had not fully verified third-party figures, and the Oct. 15 update supplies no totals or attacker names.

The company said spot purchases from stores, including in Germany, and samples from warehouses were clean. Screening of its own stock also found no compromised units.

Guidance for buyers from CryptoBilis

For buyers from CryptoBilis, a reseller initially linked to confirmed losses, Ledger's earlier instructions remain in effect.

• Do not initialize an unused device.
• If already set up, promptly move assets to a new device with a new recovery phrase.
• Avoid entering or restoring any recovery phrase on a CryptoBilis-bought device.

Ledger also now requires authorized sellers to report unusual products flagged by customers promptly.

Work with law enforcement continues

Ledger said it is working with law enforcement and the security community to trace funds and dismantle the attackers' infrastructure. The company plans to release more details and a fuller technical disclosure when it can.

Key points

• Ledger blames an organized criminal group for a months-long campaign to tamper with hardware wallets.
• The implant steals the 24-word recovery phrase during setup and transmits it over LTE.
• The attack is limited to devices after they leave Ledger's control, not a compromise of its chip or software.
• Ledger now requires authorized resellers to keep devices off displays and never resell returned items.
• No total number of affected users or value lost has been confirmed.

What is confirmed

• An organized group tampered with genuine Ledger wallets in Southeast Asian resale channels.
• The implant reads and transmits recovery phrases via LTE and an eSIM.
• The Secure Element chip and operating system remain unchanged.
• Ledger's Genuine Check cannot detect external spying hardware when the original chip is intact.
• Wallets purchased from CryptoBilis have been linked to confirmed losses.

What is still unclear

• The total number of affected users and value lost have not been confirmed.
• The identity of the attackers has not been disclosed.
• Full technical disclosure is pending further investigation.

Why this matters for wallet users

The attack shows that even genuine hardware wallets can be compromised after leaving the manufacturer's control. Users who buy from unauthorized resellers or purchase returned devices may face risks that standard authenticity checks cannot detect.

Sources

• The Defiant

Read also: Safe launches Safenet Aegis security network on three chains