Ledger Officially Responds to Hardware Wallet Attack

Ledger says attackers planted hidden components in genuine hardware wallets to steal users' recovery phrases, prompting new security measures and a regional sales suspension.

What's the Scoop?

• The Attack: In its latest disclosure, Ledger says an organized criminal group spent months buying genuine devices, installing hidden components designed to steal users' recovery phrases during setup, and redistributing them through resellers in Southeast Asia.

• Millions Stolen: The implants captured users' 24-word recovery phrases and transmitted them over cellular networks, allowing attackers to drain wallets. Onchain researchers estimate losses of up to $93M across more than 300 wallets, though Ledger has not confirmed the total.

• Ledger's Response: The company asked authorized resellers and distributors across Southeast Asia and Hong Kong to suspend sales while it investigates. It also inspected devices from stores and warehouses, including in Germany, reporting that all examined samples were clean.

• Tighter Security: Ledger is introducing new reseller requirements, including keeping devices off store shelves and immediately reporting suspicious products, while reinforcing its existing ban on reselling returned devices. Importantly, Ledger maintains that its chips, operating systems, and servers were never compromised, with the attack instead exploiting its distribution network.