Ledger has disclosed details of a coordinated criminal operation that allegedly tampered with genuine hardware wallets to steal cryptocurrency users’ recovery phrases. The attackers modified devices before redistributing them through third-party channels in Southeast Asia. Ledger says its secure element chips, BOLOS operating system and internal servers were not compromised, describing the incident as a localized distribution attack.
Ledger Says Criminals Modified Wallets Over Several Months
In its October 15 investigation update, Ledger said the group purchased genuine devices, opened them and installed custom-built components designed to capture recovery phrases during initial setup. The attackers then returned the modified wallets to distribution channels, allowing unsuspecting customers to use compromised hardware. Ledger said the operation also involved infrastructure built to collect recovery phrases, drain wallets and launder stolen funds.
The company described the operation as a coordinated effort that required significant resources and planning. Its security team, Ledger Donjon, examined the implanted hardware to understand how it worked. The company said it also inspected devices purchased from retail stores and samples from warehouses, reporting that the units examined during its investigation were clean.
Also Read: Ledger Wallet Sales Halted in Germany as Hardware Implant Probe Expands
Ledger Suspends Sales Across Southeast Asia and Hong Kong
Ledger has asked authorized resellers and distributors across Southeast Asia and Hong Kong to suspend sales while the investigation continues. The company is also tightening handling procedures, requiring devices to remain off open shelves and display areas until purchase. It has reiterated that returned devices must never be resold, even if they appear unopened or unused.
These measures target the distribution process rather than a confirmed vulnerability in the company’s core technology. However, the incident demonstrates that a genuine device and apparently intact packaging cannot, by themselves, eliminate every supply-chain risk. The company says it is working with law enforcement and the security community to trace funds and investigate the criminal infrastructure.
Recovery Phrase Theft Can Bypass Hardware Wallet Protection
Hardware wallets are designed to keep private keys isolated from internet-connected devices, reducing exposure to remote malware. A recovery phrase, however, can restore access to the wallet and its assets, making it a critical target for attackers. If criminals obtain the phrase, they may be able to access funds without physically possessing the original device.
The company’s security guidance on tampered devices warns that modified hardware can expose recovery information during use. The company also advises customers never to enter their recovery phrase into an application or website. This distinction is important because hardware security depends not only on the device itself but also on how it is sourced, initialized and used.
Ledger Tightens Security as Users Reassess Self-Custody Risks
Ledger said it found no compromised units among the stock samples it screened and maintains that its internal systems remain intact. That statement does not mean every device sold through every third-party channel has been independently verified. The company has promised further technical details when it can share them without compromising the investigation.
For users, the immediate priority is to treat suspicious devices seriously and follow official guidance rather than relying solely on packaging or appearance.
Anyone who believes a wallet may be affected should contact the company through its official support channels and avoid entering the recovery phrase into connected devices or sharing it with anyone. The investigation may also prompt other hardware-wallet makers and distributors to review inspection procedures, returned-device policies and supply-chain controls.
Also Read: XRP Ledger Security Fix Addresses Critical Supply Vulnerability
Be the first to comment