Ledger has introduced new security requirements for its authorized retailers on October 15, 2026, after attackers installed hidden electronic components inside genuine cryptocurrency wallets
Ledger has introduced new security requirements for its authorized retailers on October 15, 2026, after attackers installed hidden electronic components inside genuine cryptocurrency wallets to steal users’ recovery phrases and access their funds.
SummaryThe hardware wallet manufacturer confirmed that attackers had purchased legitimate devices, modified them and returned them to circulation through distribution channels in Southeast Asia. Ledger has suspended regional reseller sales, inspected devices from retail stores and warehouses, and begun working with law enforcement to trace the stolen funds.
The company maintains that its internal systems, operating software and security chips were not compromised. Investigators are continuing to establish the full extent of the attack, including how the modified devices entered the market.
You might also like: XRP Ledger builders to test native lending before validator approval
Ledger’s investigation found that the attackers had spent months preparing the operation. They purchased genuine hardware wallets, opened the devices and inserted custom electronic components designed to capture recovery phrases during setup.
How a company behaves when it is attacked says more about it than any product launch. Here is where we stand on the hardware implant attack: what happened, how we responded, and what we are changing. Read the blog here, and watch the keynote live at 2pm CET:…
— Ledger (@Ledger) October 15, 2026
A recovery phrase typically contains 24 words that allow a user to restore access to a cryptocurrency wallet. Anyone who obtains those words can potentially recreate the wallet on another device and transfer its assets.
The attackers exploited the moment when the recovery phrase appeared on the device’s screen. A hidden component collected the words and transmitted them to infrastructure controlled by the criminals.
In its October 13 technical update, Ledger’s Donjon security team explained that the implant used a microcontroller to read the phrase and an embedded SIM to transmit the information through an LTE cellular connection.
The company stated that the implant operated independently of the device’s Secure Element, which protects sensitive cryptographic information. Investigators found no evidence that the malicious component modified the operating system or altered transaction signatures.
Earlier investigations into hidden chips inside Ledger wallets documented how unauthorized electronics could expose recovery phrases without changing the device’s normal signing functions.
Ledger’s latest statement described an organized criminal operation involving equipment procurement, distribution arrangements and infrastructure for collecting stolen wallet credentials.
The manufacturer claimed that the group had spent millions preparing the attack. It did not provide a financial breakdown or identify the people responsible.
Attackers reportedly used the collected recovery phrases to access multiple wallets during a coordinated theft operation on October 9.
Although independent blockchain investigators have estimated losses exceeding $86 million, Ledger has not verified the total amount stolen or the number of affected customers.
Following the discovery, Ledger asked authorized resellers and distributors throughout Southeast Asia and Hong Kong to suspend device sales while investigators examined the affected distribution channels.
The restrictions covered Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.
CryptoBilis, a reseller operating in Southeast Asia, had previously been linked to confirmed cases involving modified devices.
The company suspended hardware wallet sales after reports emerged that customers had lost funds.
Previous reporting on the CryptoBilis wallet investigation documented Ledger’s discovery of an unauthorized implant and its initial response to customer complaints.
Ledger later expanded its precautions beyond the reseller after receiving reports involving other locations.
In Germany, MediaMarkt Saturn stopped selling Ledger devices through its physical stores and online platform following a reported implant in a customer’s device.
Ledger stated that the German case had not resulted in any confirmed loss of customer funds.
The incident prompted a separate suspension of Ledger wallet sales in Germany while the company reviewed devices and investigated the circumstances.
During its October 15 update, Ledger said its investigators had purchased devices from stores in different markets, including Germany, and opened them for physical examination.
The company examined samples from warehouses and screened portions of its own inventory.
No unauthorized components were discovered in the samples inspected during those checks, according to Ledger.
However, the company did not disclose how many devices were examined, leaving the total number of potentially affected products unconfirmed.
Ledger described the incident as “a localized distribution attack” and maintained that its manufacturing systems were not responsible for the compromise.
The investigation has not yet established precisely where every affected device was modified.
As part of its response, Ledger has ordered authorized retailers to change how they store and sell hardware wallets.
Retailers must stop placing Ledger devices on display shelves and counters. Instead, they must keep products in storage areas and hand them to customers only when a purchase takes place.
The company introduced the requirements immediately, explaining that the measures were intended to reduce opportunities for unauthorized handling.
Ledger reminded authorized sellers that returned devices must never be sold again, even when their packaging appears unopened or the product looks unused.
The rule already existed, but Ledger has instructed distributors to follow it without exceptions.
Retailers must promptly notify the manufacturer whenever customers report unusual products or potentially suspicious hardware.
The company is tightening oversight of its authorized distribution network while the investigation continues.
Ledger stated that its security team had conducted the largest internal investigation in the company’s history, drawing on several departments.
Specialists from Ledger Donjon dismantled the recovered implant and examined its operation to establish how attackers collected recovery phrases.
The manufacturer worked with security researchers and industry partners, including SEAL_911, during the investigation.
According to Ledger, the teams are working with law enforcement to trace stolen funds and identify the infrastructure used to collect wallet credentials.
The company has not disclosed arrests, formal criminal charges or recovered funds arising from those efforts.
Ledger said it intends to publish additional technical information when investigators can safely release their findings.
Beyond its immediate retail restrictions, Ledger is developing additional product security measures intended to make physical tampering more difficult.
The company has not provided technical specifications, affected product models or a timetable for introducing those protections.
Ledger stated that it would share findings with other hardware wallet manufacturers and sellers so they could examine similar risks in their products.
The manufacturer has previously warned customers who purchased devices through CryptoBilis not to initialize them before contacting official support.
Customers who already used a potentially affected wallet have been advised to transfer their cryptocurrency to a trusted device with a newly generated recovery phrase.
Restoring an old recovery phrase on a replacement device would not secure funds if attackers had already obtained that phrase.
Ledger’s security guidance warns users never to disclose their recovery phrases to anyone claiming to represent customer support.
The company has stressed that its employees will not request recovery words through messages, phone calls or websites.
During its October 15 announcement, Ledger acknowledged that the investigation was continuing and that additional security work remained.
The manufacturer reiterated its intention to release further details about the attack and the methods used by the criminals once its investigation permits disclosure.
Read more: Europe’s banks have a euro stablecoin license. Can they win users?
