Ledger Says Tampered Devices Stole Recovery Phrases, Seeks Sales Halt in Southeast Asia and Hong Kong

Hardware wallet maker Ledger has disclosed the details of a recent attack in which unauthorized components were inserted into its devices to steal users' assets. The company said it will tighten standards for product sales and inventory management.

In a post on its official blog on Oct. 15, Ledger said a criminal group bought genuine devices over several months, inserted specially made parts inside them and redistributed the products through resellers in Southeast Asia. The component was designed to capture the wallet recovery phrase used during initial setup.

The attackers also built separate infrastructure to collect recovery phrases, steal assets and launder funds. Ledger said the group prepared the operation over an extended period before draining wallet assets in a coordinated wave.

Ledger said its proprietary chip, operating system and internal systems were not compromised. The company described the incident as a localized attack tied to a specific distribution channel.

Ledger also asked authorized resellers and distributors in Southeast Asia and Hong Kong to stop selling its products. It is also working with local investigators and the security community to trace the stolen funds.

The company said it has strengthened its distribution-control guidelines as well. Ledger reiterated its existing rule that returned products cannot be resold, even if they appear unopened.

As immediate additional steps, the company called for products to be removed from store shelves and display stands, stored in back-room inventory and handed to customers only at the time of purchase. It also told sellers to quickly report any suspicious products flagged by customers.