Ledger announced on October 15, 2026, new security requirements for its authorized retailers. Previously, attackers installed hidden electronic components within genuine cryptocurrency wallets to steal users' recovery phrases and access their funds.
Ledger states that, following incidents where criminals tampered with authentic hardware wallets to steal cryptocurrency, the company has tightened its reseller policies.
- Hidden implants capture wallet recovery phrases during device setup and transmit sensitive information via cellular networks.
- During its investigation of affected devices, Ledger suspended authorized resale sales in Southeast Asia and Hong Kong.
- The security team inspected retail and warehouse equipment and reported that no affected devices were found in the sampled units.
- Ledger has requested retailers to stop displaying wallets and to prohibit the resale of returned devices without exception.
The hardware wallet manufacturer confirmed that attackers purchased legitimate devices, modified them, and reintroduced them into the market through distribution channels in Southeast Asia. Ledger has suspended resale sales in the region, inspected devices from retail stores and warehouses, and begun cooperating with law enforcement to trace the stolen funds.
The company stated that its internal systems, operating software, and security chips were not compromised. Investigators are continuing to determine the full scope of the attack, including how the tampered devices entered the market.
The Ledger wallet attack involves a hidden recovery phrase implant.
Ledger’s investigation found that the attackers spent months preparing for this operation, purchasing genuine hardware wallets, disassembling the devices, and inserting custom electronic components designed to capture recovery phrases during setup.
A recovery phrase typically consists of 24 words that allow users to regain access to their cryptocurrency wallet. Anyone who obtains these words could recreate the wallet on another device and transfer its assets.
Attackers exploit the moment when the recovery phrase appears on the device screen. Hidden components collect these words and transmit them to infrastructure controlled by criminals.
In the October 13 technical update, Ledger’s Donjon security team explained that the implant uses a microcontroller to read the phrase and transmits the information via an embedded SIM card over an LTE cellular connection.
The company stated that the implant operates independently of the Secure Element that protects sensitive cryptographic information. Investigators found no evidence that malicious components modified the operating system or altered transaction signatures.
Previous investigations into hidden chips in Ledger wallets documented how unauthorized electronic components could expose recovery phrases without altering the device’s normal signing functionality.
Ledger's latest statement describes this as an organized criminal operation involving the procurement of devices, distribution arrangements, and infrastructure used to collect stolen wallet credentials.
The manufacturer stated that the group spent millions of dollars on the attack, but did not provide a financial breakdown or identify any individuals involved.
According to reports, the attackers used the collected recovery phrases to access multiple wallets in a coordinated theft on October 9.
Although independent blockchain investigators estimate losses exceeding $86 million, Ledger has not yet verified the total amount stolen or the number of affected customers.
Ledger has paused wallet sales in Southeast Asia.
After identifying the issue, Ledger requested that its authorized distributors and resellers in Southeast Asia and Hong Kong suspend device sales until investigators have examined the affected distribution channels.
Restricted regions include Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong.
A reseller in Southeast Asia, CryptoBilis, was previously linked to confirmed cases involving tampered devices.
After customers reported losses of funds, the company suspended the sale of hardware wallets.
Previous reports on the CryptoBilis wallet investigation documented Ledger’s discovery of unauthorized components and its initial response to customer complaints.
After receiving reports involving other locations, Ledger subsequently expanded its preventive measures beyond that reseller.
In Germany, MediaMarkt Saturn ceased selling Ledger devices through its physical stores and online platform after a customer's device was reported to have been compromised.
Ledger stated that the German case did not result in any confirmed losses of customer funds.
This incident led to the separate suspension of Ledger wallet sales in Germany, with the company simultaneously reviewing the devices and investigating the matter.
In the October 15 update, Ledger stated that investigators purchased devices from stores in various markets, including Germany, and disassembled them for physical inspection.
The company also inspected warehouse samples and screened a portion of its own inventory.
Ledger stated that no unauthorized components were found in the samples inspected during these checks.
However, the company did not disclose how many devices were inspected, so the total number of potentially affected products remains unconfirmed.
Ledger described the incident as a "partial distribution attack" and maintained that its manufacturing system was not the cause of the breach.
The investigation has not yet precisely determined where each affected device was modified.
Ledger introduces new rules for hardware wallet retailers
As part of the response measures, Ledger has requested authorized retailers to change the storage and sales methods for hardware wallets.
Retailers must stop displaying Ledger devices on shelves and counters. Instead, they must store the products in warehouse areas and only hand them to customers at the time of purchase.
The company stated that these requirements are effective immediately, aiming to reduce opportunities for unauthorized access to devices.
Ledger also reminds authorized resellers that returned devices must never be resold, even if the packaging appears unopened or the product appears unused.
This rule already existed, but Ledger has required distributors to enforce it without exception.
Retailers must promptly notify the manufacturer when customers report abnormal products or suspicious hardware.
As the investigation continues, the company is strengthening its oversight of its authorized distribution network.
Ledger stated that its security team conducted the largest internal investigation in the company's history, involving multiple departments.
Experts from Ledger Donjon disassembled the recovered implants and examined their operation to determine how the attackers collected recovery phrases.
During the investigation, the manufacturer collaborated with security researchers and industry partners, including SEAL_911.
Ledger stated that the team is collaborating with law enforcement to track the stolen funds and identify the infrastructure used to collect wallet credentials.
The company has not disclosed any related arrests, formal criminal charges, or recovery of funds.
Ledger says the company plans to release additional technical information once investigators are able to safely disclose their findings.
Ledger plans to enhance protection against wallet tampering.
In addition to the current retail restrictions, Ledger is developing additional product security measures designed to make physical tampering more difficult.
The company has not yet provided technical specifications, affected product models, or a timeline for implementing these protections.
Ledger stated that it will share the findings with other hardware wallet manufacturers and retailers so they can review their own products for similar risks.
The manufacturer previously warned customers who purchased devices through CryptoBilis not to initialize the device before contacting official support.
For customers who have used potentially affected wallets, the company recommends transferring their cryptocurrency to a trusted device and generating a new recovery phrase.
If an attacker has already obtained the old recovery phrase, restoring the old phrase on a replacement device does not secure your funds.
Ledger’s security guidelines remind users never to disclose their recovery phrase to anyone claiming to be customer support.
The company emphasizes that its employees will never request recovery phrases via messages, phone calls, or websites.
In its October 15 announcement, Ledger acknowledged that the investigation is still ongoing and that additional security work remains to be completed.
The manufacturer reaffirmed that it will release further details about the attack and the methods used by the criminals once the investigation permits disclosure.