Ledger announced on October 15, 2026, new security requirements for its authorized retailers. Previously, attackers installed hidden electronic components in genuine cryptocurrency wallets to steal users' recovery phrases and access their funds.

Ledger indicates that after criminals tampered with genuine hardware wallets to steal cryptocurrencies, the company has tightened the regulations for resellers.

• Hidden implants will capture wallet recovery phrases during the device setup process and transmit sensitive information over cellular networks.
• Ledger suspended authorized resale sales in Southeast Asia and Hong Kong during the investigation of affected devices.
• The security team inspected retail and warehouse equipment and stated that no affected devices were found in the sampled inspections.
• Ledger has required retailers to stop displaying the wallets and has prohibited the resale of returned devices without exception.

This hardware wallet manufacturer confirmed that attackers purchased legitimate devices, modified them, and then re-sold them onto the market through distribution channels in Southeast Asia. Ledger has suspended resale sales in that region, inspected devices from retail stores and warehouses, and began cooperating with law enforcement authorities to trace the stolen funds.

The company stated that its internal systems, operating software, and security chips have not been compromised. Investigators are still working to determine the full extent of this attack, including how these tampered devices made their way into the market.

Ledger Wallet attacks involve the implantation of hidden recovery phrase plugins

According to the investigation by Ledger, the attackers prepared for this operation over several months. They purchased genuine hardware wallets, disassembled the devices, and inserted custom electronic components in order to capture the recovery phrases during the setup process.

Recovery phrases usually contain 24 words, which users can use to regain access to their cryptocurrency wallets. Anyone who obtains these words could potentially recreate the wallet on another device and transfer its assets.

Attackers take advantage of the moment when recovery phrases appear on the device screen. Hidden components collect these words and transmit them to infrastructure controlled by criminals.

In the technical update on October 13th, the security team of Ledger's Donjon explained that this implant uses a microcontroller to read phrases and transmits information through an embedded SIM card via LTE cellular connections.

The company stated that this implant operates independently of the Secure Element system, which is used to protect sensitive encrypted information. Investigators did not find any evidence of malicious components modifying the operating system or altering transaction signatures.

A previous investigation into the hidden chip in the Ledger wallet documented how unauthorized electronic components could expose the recovery phrase without altering the device's normal signing function.

Ledger The latest statement describes this as an organized criminal operation involving equipment procurement, distribution arrangements, and infrastructure used to collect credentials from stolen wallets.

The manufacturer claimed that the gang spent millions of dollars on this attack, but did not provide a breakdown of the financial costs, nor did they identify any individuals involved.

It is reported that the attackers used the collected recovery phrases to access multiple wallets during a coordinated theft operation on October 9th.

Although independent blockchain investigators estimate losses to exceed $86 million, Ledger has not yet verified the total amount stolen or the number of affected customers.

Ledger Suspends wallet sales in Southeast Asia

After discovering the issue, Ledger required authorized dealers and distributors in Southeast Asia and Hong Kong to suspend device sales until investigators inspect the affected distribution channels.

The restricted regions include Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong.

A reseller in Southeast Asia, CryptoBilis, has previously been associated with confirmed cases involving device tampering.

After customers reported financial losses, the company temporarily suspended the sale of hardware wallets.

Previous reports on the investigation of the CryptoBilis wallet documented Ledger's discovery of unauthorized implants and its initial response to customer complaints.

After receiving reports involving other locations, Ledger subsequently extended the preventive measures beyond that reseller.

In Germany, MediaMarkt Saturn ceased selling Ledger devices through physical stores and online platforms after a report of an implant in a customer's device.

Ledger indicates that the German case did not result in any confirmed losses of customer funds.

This incident also led to the temporary suspension of the sales of Ledger wallets in Germany, with the company simultaneously reviewing the devices and investigating the related circumstances.

In the update on October 15th, Ledger indicated that investigators purchased devices from stores in different markets, including Germany, and disassembled them for physical inspection.

The company also inspected warehouse samples and screened a portion of its own inventory.

According to Ledger, no unauthorized components were found in the samples selected for inspection during these checks.

However, the company has not disclosed how many devices were inspected, so the total number of potentially affected products remains undetermined.

Ledger described this incident as a "partial denial of service attack" and insisted that the system created to cause it was not the reason for the damage incurred this time.

The investigation has not yet precisely determined where each affected device was modified.

Ledger Launches New Rules for Hardware Wallet Retailers

As part of the response measures, Ledger has requested authorized retailers to change the way they store and sell hardware wallets.

Retailers must stop placing Ledger devices on display shelves and counters. Instead, they must store the products in the warehouse area and only hand them over to customers when a purchase occurs.

The company stated that these requirements are effective immediately, with the aim of reducing the chances of unauthorized access to devices.

Ledger also reminds authorized resellers that the returned devices must not be sold again, even if the packaging appears unopened or the product seems to have never been used.

This rule already existed, but Ledger has required distributors to implement it without exception.

Retailers must notify manufacturers promptly when customers report defective products or suspicious hardware.

As the investigation continues, the company is strengthening its supervision over the authorized distribution network.

Ledger indicates that its security team conducted the largest internal investigation in the company's history, involving multiple departments.

Experts from Ledger Donjon disassembled the recovered implants and examined their workings to determine how attackers collected recovery phrases.

During the investigation, the manufacturer collaborated with security researchers and industry partners, including SEAL_911.

Ledger indicates that the team is cooperating with law enforcement authorities to track the stolen funds and identify the infrastructure used to collect wallet credentials.

The company has not disclosed any information regarding the arrests, formal criminal charges, or the recovery of funds.

Ledger said that when the investigators are able to safely disclose the results, the company plans to release more technical information.

Ledger Plans to Further Protect Against Wallet Tampering

In addition to the current retail restrictions, Ledger is also developing additional product security measures aimed at making physical tampering more difficult to carry out.

The company has not yet provided technical specifications, affected product models, or a timeline for implementing these protective measures.

Ledger indicates that the survey results will be shared with other hardware wallet manufacturers and sellers, so that they can examine similar risks in their own products.

The manufacturer previously warned customers who purchased devices through CryptoBilis not to initialize the devices before contacting official support.

For customers who have already used wallets that may be affected, the company recommends transferring their cryptocurrencies to a trusted device and generating a new recovery phrase.

If the attacker has already obtained the old recovery phrase, then restoring the old phrase on a replacement device does not guarantee the security of funds.

Ledger's security guidelines remind users not to disclose the recovery phrase to anyone who claims to represent customer service.

The company emphasizes that its employees will not request recovery words via messages, phone calls, or websites.

In the announcement on October 15th, Ledger acknowledged that the investigation is still ongoing and that there is further security work to be completed.

The manufacturer reiterates that once the investigation permits disclosure, more details regarding this attack and the methods used by the criminals will be released.