According to an official announcement from Ledger, a highly organized criminal gang purchased genuine Ledger devices over several months, disassembled them, and implanted customized hidden components.
According to an official announcement from Ledger, a highly organized criminal gang purchased genuine Ledger devices over several months, disassembled them, and implanted customized hidden components to steal mnemonic phrases during device initialization. They then funneled the devices back into the sales channels through Southeast Asian distributors.
The gang spent millions of dollars on this operation and built their own mnemonic collection servers and infrastructure for theft and money laundering. Ledger stated that its chips, operating systems, and servers were not compromised, and the attack occurred during the distribution phase after the devices left its control.
Ledger has requested Southeast Asian and Hong Kong authorized distributors to suspend sales. Effective immediately, products are not to be displayed and should be delivered from inventory upon sale, with returned devices prohibited from being resold in any form.
Random checks of devices in the German market and warehouses found no anomalies. Ledger stated it is cooperating with law enforcement and SEAL 911 to trace the funds.
A complete technical disclosure will be released later. The criminal gang completed the attack chain by purchasing genuine devices, implanting components, and funneling them back through distributor channels.
This incident occurred during the distribution phase after the genuine devices left the manufacturer's control. The flow of funds relates to the purchase of devices, the implantation of customized components, and the construction of mnemonic collection servers. The criminal gang accessed users through the return channels, while Ledger responded by suspending sales, changing delivery methods, and cooperating with law enforcement. Distributors that continue to display or resell returned devices face immediate pressure to adjust their practices.
Source: Public information
ABAB AI Insight
Ledger has long sold hardware wallets through an authorized distributor network, with devices entering multi-tier distribution after leaving the factory. This announcement reveals that a criminal gang purchased genuine devices over several months, disassembled them to implant hidden components, and funneled them back through Southeast Asian distributor channels. The attack point lies outside the manufacturer's control in the distribution phase, continuing a common path of supply chain tampering in hardware security incidents.
The resource adjustments mainly involve requiring Southeast Asian and Hong Kong authorized distributors to suspend sales, prohibit display, switch to inventory delivery upon sale, and ban the resale of returned devices. The motivation is to cut off the return path for implanted devices while cooperating with law enforcement and SEAL 911 to trace funds, and preparing to release a complete technical disclosure to clarify attack details.
Similar supply chain tampering can be seen in cases where malicious components are implanted in certain electronic products during distribution before they return to the market, as well as previous risk warnings in the hardware wallet industry regarding second-hand or non-official channel devices. Currently, Ledger is in the channel control and law enforcement cooperation phase after confirming the incident, shifting focus from the product itself to restrictions on delivery and resale in the distribution phase.
Essentially, this represents a restructuring of the industrial chain. The distribution process of genuine devices has been altered by the implanted components and return operations, with the manufacturer regaining control over shipping points by adjusting the sales and delivery rules for authorized distributors. Mechanically, after leaving the manufacturer, devices are purchased, tampered with, and re-enter sales channels at the distributor level. Ledger cuts off this path by suspending sales, prohibiting display, and restricting resale, shifting subsequent device delivery from public display to immediate inventory delivery, thus moving the control point in the distribution phase back to the manufacturer's designated rules.
ABAB News · Cognitive Law
- Tampering in the distribution phase occurs before devices reach users.
- Suspending sales cuts off the return of devices into channels.
- Official website and inventory delivery reduce the space for intermediate implantation.