The Singapore police said that, since September 10, they have received at least two cases suspected to involve tampered Ledger hardware wallets, with combined losses of approximately 3500000 Singapore dollars; the investigation remains ongoing.
PANews reported that former Mt. Gox CEO Mark Karpelès said he is developing a low-cost device that can detect suspected spy implants without disassembling hardware wallets, and plans to make its PCB design and specifications public.
According to Cointelegraph, Mark Karpelès and security researcher Joe Grand said they had reported suspected tampered devices to Ledger.Ledger confirmed receipt of Grand's finding and said it was conducting an internal investigation.
The PANews Telegram channel said that Ledger suspected hardware implants were found in distributor channels, attackers may have stolen seed phrases through the screen data cable, and users who recently purchased devices were advised to migrate their assets. The scale of the related losses and incident details have not yet been independently verified.
SlowMist monitoring found that attackers created spoofed firmware update pages by exploiting the recent Ledger supply chain incident, luring users into taking action and entering their seed phrases.
Ledger says a criminal syndicate dismantled genuine devices and implanted concealed components, stealing recovery seed phrases during initialization and selling the devices through Southeast Asian channels. The company has suspended sales in the relevant regions and inspected inventory.
Ledger Launched amid an unresolved security alert Atom hardware wallet, marketed around dual operating systems, hardware-level tamper resistance, and AI Agent functionality, but the product timing and design sparked community controversy.
Former Mt. Gox CEO Mark Karpelès said he had established Ledger a compilation page of cases involving tampered and counterfeit hardware wallets, documenting 14 devices and 7 named sellers. The page is a personal open-source intelligence compilation, not an Ledger official investigation conclusion.
Ledger said it had tested German retail and distribution inventory devices and found no signs of tampering; there are no related reports of financial losses in Europe. The device involved in the online exposure has not yet been submitted for testing.
Ledger has asked distributors in six Southeast Asian countries and Hong Kong to suspend sales and remove hardware wallets from shelves while investigating suspected device tampering and related theft incidents.
According to a Bloomberg report,Ledger said that after some hardware wallets were found to have allegedly been implanted with spyware, causing estimated losses of more than 90000000 USD it would review its sales, supply chain, and tamper-resistance processes.
MediaMarktSaturn has delisted Ledger products from its stores and online platforms and is communicating with Ledger. Multiple users reported that the devices contained unauthorized cables or cellular modules;Ledger is investigating.