According to Cointelegraph, Mark Karpelès and security researcher Joe Grand said they had reported suspected tampered devices to Ledger.Ledger confirmed receipt of Grand's finding and said it was conducting an internal investigation.
SlowMist monitoring found that attackers created spoofed firmware update pages by exploiting the recent Ledger supply chain incident, luring users into taking action and entering their seed phrases.
Ledger says a criminal syndicate dismantled genuine devices and implanted concealed components, stealing recovery seed phrases during initialization and selling the devices through Southeast Asian channels. The company has suspended sales in the relevant regions and inspected inventory.
Ledger says a criminal gang purchased genuine devices, implanted hidden components, stole recovery phrases during initialization, and then returned the devices to sales through Southeast Asian distributors. Ledger has asked authorized distributors in Southeast Asia and Hong Kong to suspend sales and strengthen inventory-delivery controls.
Ledger said that some genuine devices had concealed components installed after leaving the company's control to steal recovery seed phrases, and required authorized channels in Southeast Asia and Hong Kong to suspend sales. The company stated that its chips, systems, and servers were not compromised.
Hacken said that 2026 in the third quarter of the year, the crypto industry experienced 107 attacks, resulting in losses of 1180000000 USD, with approximately 77%of the losses related to issues involving vendors, development tools, and infrastructure.
Trezor said it would reduce the number of partner distributors to strengthen channel review and supply chain security management, adding that there is currently no evidence that its hardware wallet devices have been compromised.
According to a Bloomberg report,Ledger said that after some hardware wallets were found to have allegedly been implanted with spyware, causing estimated losses of more than 90000000 USD it would review its sales, supply chain, and tamper-resistance processes.
MediaMarktSaturn has delisted Ledger products from its stores and online platforms and is communicating with Ledger. Multiple users reported that the devices contained unauthorized cables or cellular modules;Ledger is investigating.
BlockBeats reported that Bitcoin retreated by more than 2%after surging, while oil prices rose to a near-1-month high, intensifying market risk aversion.
User Johannes said that two Ledger hardware wallets purchased from European retailer MediaMarkt were found to contain suspected spyware and hardware modifications; the relevant cause and scope of impact remain subject to verification.