Hardware wallet maker Ledger classified a case in which illicit components were inserted into its hardware wallets as an organised crime group attack targeting the distribution chain and disclosed countermeasures. CoinPost reported on Oct. 16 that Ledger said on Oct. 15 the attack was a sophisticated crime prepared over several months.

The attackers bought genuine Ledger devices and opened them, then planted illicit components designed to steal recovery phrases. The devices were distributed through a Southeast Asian sales agency network, and the components were designed to activate when users carried out initial setup. The attackers also separately built infrastructure for recovery-phrase collection servers, asset theft and money laundering. Ledger explained that they invested millions of dollars to systematically steal users' assets.

Ledger stressed there were no flaws in its chips, operating system or servers, and that its systems themselves were not breached. It said the attack targeted the distribution chain after the devices left Ledger's control.

Ledger is currently cooperating with law enforcement agencies to track stolen funds and dismantle the attack infrastructure. It also plans to share technical information within possible limits so other companies in the industry can strengthen security.

Only external estimates of the damage have been released. Bitquery estimated that about $93.2 million had been siphoned out as of Oct. 11. Ledger said the figures circulating online were presented by third parties and it had not sufficiently verified them.

Ledger's security team dismantled the illicit components and analysed how they operated. It sent investigation teams to several regions including Germany, bought products directly from stores for unboxing inspections, and conducted sample checks of warehouse inventory. No anomalies were confirmed within the scope of the investigation. It requested official dealers in Southeast Asia and Hong Kong to suspend sales, and said no illicit devices were found in its own inventory.

Ledger reiterated an existing rule to official retailers and dealers that returned devices cannot be resold. There are no exceptions, even if a product looks new or appears to be unopened. It also barred products from being displayed on store shelves or in displays, and instructed that inventory be kept in back rooms and handed to customers only at purchase. It added a procedure requiring immediate contact with Ledger when a customer reports an abnormal product.

Ledger also announced a new mobile device, the Ledger Atom, on Oct. 15. The product was designed with security as the focus, and it also plans to include solutions to respond to product tampering or illicit unsealing. Shipments are expected to begin in 2027.