Ledger Responds to Hardware Implant Attack: A Localized Distribution Channel Attack, Halts Sales at Authorized Channels in Southeast Asia and Hong Kong

BlockBeats news, October 15: Crypto hardware wallet manufacturer Ledger issued a statement in response to a hardware implant attack, saying that a highly organized criminal group spent months purchasing genuine devices, disassembling them and installing custom hidden components to steal users' recovery seed phrases generated during the initialization process, then reintroducing them into the market through Southeast Asian distributors. Ledger said the attackers invested millions of dollars, built their own logistics, seed phrase collection servers, fund theft and money laundering infrastructure, and stole user wallet funds through a coordinated operation.

Ledger emphasized that the attack did not stem from vulnerabilities in its chips, operating system or servers, and that the company's own systems were not compromised. The company characterized the incident as a localized distribution channel attack that occurred after devices left its control, rather than a systemic supply chain attack. Ledger said it has launched the largest investigation in its history, and its security lab Ledger Donjon has disassembled the implanted components and confirmed how they work.

The company has asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales, and has sent teams to stores in Germany and other places to purchase and inspect devices, while also checking warehouse and its own inventory samples. Ledger said no tampering was found in any of the inspected devices. Currently, the company is working with law enforcement agencies and the security community to trace the funds and dismantle the attackers' infrastructure.

Regarding channel management, Ledger reiterated that returned devices must not be resold in any form, even if they appear brand new and unopened. Effective immediately, authorized channels may not place products on shelves or display areas, inventory must be kept in the back of the store and delivered at the time of purchase, and abnormal products reported by customers must be promptly reported. The company said it is advancing more product-level protective measures, will release investigation details later, and will provide more complete technical disclosure to industry peers when conditions permit.