SecuX After announcing the completion of emergency maintenance, Ripple CTO David Schwartz said that his Android App received a push notification leading to a mnemonic-phrase phishing page. The report said that as of October 17, some users still could not access their wallets.
According to Cointelegraph, Mark Karpelès and security researcher Joe Grand said they had reported suspected tampered devices to Ledger.Ledger confirmed receipt of Grand's finding and said it was conducting an internal investigation.
The PANews Telegram channel said that Ledger suspected hardware implants were found in distributor channels, attackers may have stolen seed phrases through the screen data cable, and users who recently purchased devices were advised to migrate their assets. The scale of the related losses and incident details have not yet been independently verified.
Ledger says a criminal syndicate dismantled genuine devices and implanted concealed components, stealing recovery seed phrases during initialization and selling the devices through Southeast Asian channels. The company has suspended sales in the relevant regions and inspected inventory.
Ledger says a criminal gang purchased genuine devices, implanted hidden components, stole recovery phrases during initialization, and then returned the devices to sales through Southeast Asian distributors. Ledger has asked authorized distributors in Southeast Asia and Hong Kong to suspend sales and strengthen inventory-delivery controls.
Ledger said that some genuine devices had concealed components installed after leaving the company's control to steal recovery seed phrases, and required authorized channels in Southeast Asia and Hong Kong to suspend sales. The company stated that its chips, systems, and servers were not compromised.
Ledger Launched amid an unresolved security alert Atom hardware wallet, marketed around dual operating systems, hardware-level tamper resistance, and AI Agent functionality, but the product timing and design sparked community controversy.
Ledger launched the Atom Android device at an event in Paris Op3n event, with the Founder’s Edition priced at 849 USD, and deliveries expected in 2027 summer. The company said the device has continuously powered tamper sensors and can isolate the Android environment from the transaction security mode.
Former Mt. Gox CEO Mark Karpelès said he had established Ledger a compilation page of cases involving tampered and counterfeit hardware wallets, documenting 14 devices and 7 named sellers. The page is a personal open-source intelligence compilation, not an Ledger official investigation conclusion.
October 15, Binance founder CZ stated regarding OneKey's launch of the hardware-wallet selfie-based self-testing authentication website “Yishi Jianbao” that all hardware wallets must use transparent casings in the future.
Ledger said it had tested German retail and distribution inventory devices and found no signs of tampering; there are no related reports of financial losses in Europe. The device involved in the online exposure has not yet been submitted for testing.