Ledger: Organized Syndicate Infiltrated Supply Chain for Months to Implant Malicious Hardware and Steal Seed Phrases

In an updated investigation into the recent hardware wallet tampering incident, Ledger disclosed that an organized criminal syndicate spent months purchasing authentic Ledger devices, disassembling them to implant custom hardware designed to exfiltrate recovery phrases (seed phrases), and then redistributing the compromised units through Southeast Asian resale channels. The attackers also engineered a multi-million-dollar infrastructure to intercept seed phrases, drain user assets, and launder illicit proceeds.

Ledger emphasized that the incident constitutes an isolated attack on local third-party distribution channels, confirming that its proprietary secure element chips, operating system (BOLOS), and internal server infrastructure remain fully intact and uncompromised. The company has instructed authorized resellers and distributors across Southeast Asia and Hong Kong to temporarily suspend all sales, while enforcing stricter operational security protocols—including prohibiting devices from being displayed on open shelves or exhibition areas and strictly banning the resale of returned units. — link