Key Notes
- Ledger says criminals modified genuine devices over several months and built infrastructure to collect recovery phrases before a coordinated theft of users’ funds.
- Authorized retailers must keep devices off shelves and displays, hand them over only at purchase, and never resell returned wallets even if they appear unopened.
- Ledger denies a chip or systems compromise and says its sampled stock was clean, while affected-device counts, verified losses and a fuller technical disclosure remain outstanding.
Ledger is tightening how its authorized retailers handle hardware wallets after an implant attack that the company says involved months of preparation, millions of dollars in spending and a coordinated theft of users’ cryptocurrency.
In an October 15 response, Ledger said criminals bought genuine devices, opened them, added hidden components to capture recovery phrases during setup and returned the modified wallets to distribution through resellers in Southeast Asia. The company maintains that its chip, operating system and servers were not compromised.
The account describes a physical attack after devices left Ledger’s control. It does not provide a verified total of affected wallets or stolen funds, name the attackers, or identify every point where modified stock entered retail channels.
Wallets must come off shelves, and returns cannot be resold
The most concrete change concerns the authorized retail network. Ledger says devices should no longer be placed on shelves or displays. Inventory should instead remain in back-of-store storage and be handed to customers when they make a purchase.
Resellers and distributors must also promptly report customer complaints about unusual products. Separately, Ledger reiterated an existing rule: returned devices must never be resold, even when packaging appears new and unopened. The return restriction is a reminder of an established policy, rather than an entirely new safeguard.
The handling rules apply to Ledger’s authorized network. They sit alongside the company’s request to suspend sales in Southeast Asia and Hong Kong while the investigation continues. The response does not announce a date for resuming those sales.
CoinScreamer’s regional sales-pause report detailed the earlier request covering Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. A precautionary sales halt identifies markets where Ledger wants controls tightened; it does not establish that every device sold there was altered.
Ledger describes an organized operation, with key figures undisclosed
According to Ledger, the attackers developed logistics for acquiring and redistributing devices, servers for collecting recovery phrases, and infrastructure for draining wallets and laundering proceeds. Its description of months of preparation and millions spent is the company’s assessment, rather than an independently audited accounting published with the response.
Ledger calls the incident a “localized distribution attack” and rejects the description of a “systemic supply chain attack.” That is its characterization of the investigation’s scope. The distinction does not resolve the provenance of every device described by outside researchers.
The company says its Donjon security lab dismantled an implant and established how it worked. It also says teams bought and opened devices in local markets, including Germany, examined warehouse samples and screened its own inventory. Ledger reports that every unit in those checks was clean.
The response does not give sample sizes, store-by-store results or the full testing methodology. Finding no modified units in a sample is relevant evidence, but it cannot by itself establish that no altered wallet exists anywhere in the wider retail network.
Ledger says it is working with law enforcement and security researchers to trace funds and dismantle the attackers’ systems. It promises further technical disclosure and says additional product-level protections are being developed, without specifying their design or release dates.
A genuine secure chip does not prove the whole device is untouched
Ledger’s defense of its chip and software addresses a different question from the physical integrity of a wallet delivered to a customer. An attacker can leave genuine security components in place while adding electronics around them.
The company’s own Donjon threat model explains that Genuine Check authenticates the secure element. It cannot detect unauthorized physical modifications, including spying implants, when the original secure element remains intact.
That limitation helps explain why an apparently functional device can still be dangerous. Authentication of the chip is not a forensic examination of everything connected to it, nor a verification of each stage in the product’s journey to its buyer.
Research by Joe Grand and Tibane Labs describes Nano X implants that intercept information traveling to the display, reconstruct recovery words and transmit them through added cellular components. The mechanism captures information shown during setup instead of demonstrating a cryptographic break of the secure element.
Our Tibane analysis examines the progression from visible wires and smaller batteries to concealed flexible circuits. Those researched specimens document an attack method; they do not independently prove that every reported October loss came from the same hardware design or criminal group.
The warning history predates the October theft investigation
The attack technique was publicly discussed before this month’s incident. Grand’s research page documents his examination of a real-world Nano X implant, with slides revised May 29 and an associated hardwear.io USA presentation.
Kim Zetter’s reporting dates Grand’s disclosure meeting with Ledger to March 4, 2026. CoinScreamer’s warning timeline follows the record from an August 2025 Reddit report through that disclosure and the later public research.
Prior awareness of the technique is distinct from knowing which later retail units were affected. The October 15 response does not provide a detailed account of how distribution controls developed between the earlier warnings and the theft investigation.
Separate device reports also require individual examination. Our MediaMarkt coverage concerns a buyer’s account of altered wallets from two stores. Ledger’s statement that its own German purchases were clean does not establish the condition of those particular reported units.
Mark Karpelès’s public database organizes photographs, purchase histories and researcher classifications. A documented implant, a counterfeit device and a theft verified by the manufacturer remain different findings; retailer names in those records do not prove knowing involvement by the businesses.
The next test is disclosure and implementation
Ledger has now set out immediate retail controls and its explanation of the attack. Assessing their effectiveness will depend on implementation across distributors and stores, as well as further evidence about how devices were modified and returned to circulation.
For customers, the technical distinction remains important: replacing hardware does not revoke someone else’s access to an exposed recovery phrase. Ledger’s security guidance explains that restoring the same phrase recreates the same wallet.
The company’s response does not publish a new universal migration instruction for every Ledger owner. Its earlier CryptoBilis-specific advice, covered in our company-confirmation report, called for affected buyers to use a new device and a new seed. Those instructions should retain their stated scope while the investigation develops.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
