Hardware-wallet manufacturer Ledger is tightening its reseller and distribution controls after modified devices captured customers’ recovery phrases during setup.
Ledger said criminals purchased genuine devices, installed concealed components and returned them to circulation through resellers in Southeast Asia. The company described the incident as a localised distribution attack rather than a compromise of its chips, operating system, servers or direct-sales infrastructure.
Technology publications have linked the modified devices to approximately $93 million in stolen cryptocurrency. Ledger’s official response, updated on 15 October, does not confirm that loss estimate.
Key Takeaways
- Criminals reportedly opened genuine devices and installed components designed to capture recovery phrases during setup.
- Ledger says the affected devices were modified after leaving its control.
- The company asked authorised resellers and distributors in Southeast Asia and Hong Kong to suspend sales.
- Ledger is changing how resellers store, display and handle returned devices.
- A successful software authenticity check may not detect a component operating outside the wallet’s normal security architecture.
How the Modified Devices Worked
According to Ledger, the attackers bought genuine hardware wallets, opened them and installed hidden components capable of collecting recovery phrases. The devices were then placed back into reseller distribution.
A recovery phrase can be used to reconstruct the private keys associated with a wallet. Anyone who obtains it may therefore be able to recreate the wallet elsewhere and authorise transactions without possessing the original device.
This is why a recovery phrase must be treated differently from an ordinary password. UPay’s guide to cryptocurrency wallet types explains that wallets manage the cryptographic keys used to control blockchain assets rather than storing the assets themselves.
Once those keys can be reproduced, physical possession of the original wallet may no longer protect the funds.
Why the Attack Evaded a Software Check
Ledger said the implanted component operated outside the chip running its official firmware. Its normal authenticity test could verify the legitimate device while failing to identify separate hardware added during distribution.
This distinction does not mean that hardware wallets provide no protection. A crypto hardware wallet is designed to isolate private keys from internet-connected devices and reduce exposure to certain forms of malware.
However, offline key storage and supply-chain integrity address different risks. A legitimate hardware wallet can protect keys from an infected computer, but a device modified before purchase may interfere with the process used to create or display those keys.
The incident therefore highlights the importance of assessing both a wallet’s technical design and the route through which it reaches its owner.
Ledger Changes Its Reseller Requirements
Ledger said it examined devices from shops and warehouses without finding additional compromised units. It nevertheless suspended sales through authorised distributors in the affected regions while investigating.
The company is also introducing stricter reseller requirements. Products should be kept away from open shelves and displays, unusual-device reports must be escalated promptly, and returned devices must never be resold—even when they appear unopened.
Ledger has advised affected customers to contact its support team through official channels. Users should be particularly cautious about unsolicited messages offering wallet recovery or compensation. UPay’s guidance on choosing a crypto wallet notes that entering a recovery phrase into an unverified website or application can give an attacker control of the associated assets.
Opening a suspected device without appropriate technical guidance may also damage it or destroy useful evidence.
Conclusion
The attack did not require compromising Ledger’s servers or firmware. Instead, criminals reportedly targeted the path between legitimate production and customer setup.
That distinction makes the incident relevant beyond one manufacturer. Hardware security depends not only on how a wallet is designed, but also on how it is distributed, returned and sold. For users, verified purchasing channels and careful recovery-phrase handling remain essential parts of wallet security.
