WuBlockchain
Ledger says an organized criminal syndicate spent months buying authentic hardware wallets, implanting custom hardware to steal recovery phrases, then reselling the devices through Southeast Asian channels. The attackers built infrastructure to intercept seed phrases, drain assets and launder proceeds.
Why it matters
The attack targeted devices moving through third-party distribution channels, rather than Ledger’s proprietary secure element chips, BOLOS operating system or internal servers, which the company says remain uncompromised. The incident highlights the risk of buying hardware wallets through resale channels where device integrity may be harder to verify.
Market impact
Ledger has instructed authorized resellers and distributors across Southeast Asia and Hong Kong to suspend sales temporarily. It is also tightening operational controls, including banning open-shelf displays and the resale of returned devices.
Source: [Ledger’s Response to the Hardware Implant Attack](https://www.ledger.com/blog-response-hardware-implant-attack)
Frequently asked questions
-
How did the attackers compromise Ledger devices?
They bought authentic devices, disassembled them and implanted custom hardware designed to exfiltrate recovery phrases before redistributing the wallets through Southeast Asian resale channels.
-
What information were the implanted components designed to steal?
The custom hardware was designed to exfiltrate seed phrases, also known as recovery phrases, which could be used to access users’ assets.
-
Did the incident compromise Ledger's secure element or BOLOS?
Ledger said its proprietary secure element chips, BOLOS operating system and internal server infrastructure remain uncompromised.
-
Where did the compromised devices enter resale channels?
The devices were redistributed through Southeast Asian resale channels, and Ledger also directed authorized distributors in Hong Kong to suspend sales temporarily.
-
What steps is Ledger taking with distributors?
Ledger instructed authorized resellers and distributors across Southeast Asia and Hong Kong to pause sales temporarily and tightened controls on displays and returned devices.
CoinDesk
CryptoSlate
TheBlock
CoinTelegraph
Crypto News