Ledger says criminal gang implanted components during distribution to steal recovery phrases; sales suspended in some regions
BIBIBI
AT A GLANCE
Ledger says a criminal gang tampered with hardware wallets in an attempt to steal recovery phrases during initialization.
Article
Ledger: Criminal Gang Spent Millions USD Implanted Data-Stealing Components in Hardware Wallets
PANews October 16 reported that, according to an official Ledger announcement, a highly organized criminal gang purchased genuine Ledger devices over several months, disassembled them, and implanted customized hidden components to steal recovery phrases when the devices were initialized, then returned the devices to sales channels through Southeast Asian distributors; the gang spent millions on this effort USD, and built its own recovery-phrase collection servers and theft and money-laundering infrastructure. Ledger said that its chips, operating system, and servers were not compromised, and that the attack occurred during distribution after the devices left its control. Ledger has asked authorized distributors in Southeast Asia and Hong Kong to suspend sales, and as of today requires that products not be displayed for sale but instead be delivered from inventory when sold; returned devices may not be resold in any form. Spot checks of devices in the German market and warehouses found no abnormalities. Ledger said it is working with law-enforcement agencies and SEAL 911 to trace the funds, with further details...
Key points
01
Ledger says a highly organized criminal gang purchased genuine Ledger devices and disassembled them to implant customized hidden components.
02
Ledger says the hidden components were used to steal recovery phrases when the devices were initialized.
03
The gang returned the devices to sales channels through Southeast Asian distributors and built its own recovery-phrase collection servers and theft and money-laundering infrastructure.
04
Ledger says its chips, operating system, and servers were not compromised, and that the attack occurred during distribution after the devices left its control.
05
Ledger has asked authorized distributors in Southeast Asia and Hong Kong to suspend sales, and requires that products not be displayed for sale but instead be delivered from inventory when sold.
06
Ledger says returned devices may not be resold in any form; spot checks of devices in the German market and warehouses found no abnormalities.
07
Ledger said it is working with law-enforcement agencies and SEAL 911 to trace the funds.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This is a supply-chain security incident: after leaving Ledger’s control, the devices were opened and fitted with hidden components. If a device was indeed tampered with, the recovery phrase entered during initialization may have been collected.
Why it matters to readers
Hardware wallets depend on the integrity of the devices and distribution channels. This announcement shows that the devices’ chips, operating system, and servers were not compromised, but that the distribution stage presented a risk.
Do not judge the security of a device’s source solely by its appearance; the announcement explicitly requires sales to be suspended in the relevant regions and inventory-delivery management to be strengthened.
Risks and unknowns
The original text does not specify the affected device models, batches, regions, or number of users.
The original text does not specify whether any users’ recovery phrases have already been stolen or whether any asset losses have occurred.
The body text is truncated at “then...”; subsequent investigation and response details are incomplete.
Spot checks in the German market and warehouses found no abnormalities, which does not mean that all devices have been cleared of risk.
Related Developments
Loading event timeline…
Related concepts
Hardware wallet
A wallet that uses a dedicated physical device to protect private keys and sign transactions.
