Full Report
Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]
Analysis Summary
# Incident Report: Supply-Chain Hardware Implant Attack on Ledger Wallets
## Executive Summary
Ledger has initiated a widespread sales suspension across Southeast Asia and Hong Kong following the discovery of hardware implants in devices sold via authorized resellers. Malicious actors modified the physical hardware to intercept 24-word recovery phrases and transmit them via LTE to unauthorized parties. While Ledger's internal systems remain secure, the supply chain compromise has led to significant cryptocurrency losses for users who purchased tampered devices.
## Incident Details
- **Discovery Date:** October 9, 2026
- **Incident Date:** Ongoing (Reported October 2026)
- **Affected Organization:** Ledger (Resellers: CryptoBilis, Metapod, MediaMarkt/Aqipa GmbH)
- **Sector:** Cryptocurrency / Hardware Security
- **Geography:** Southeast Asia (Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia), Hong Kong, and Europe.
## Timeline of Events
### Initial Access
- **Date/Time:** Pre-October 2026 (exact dates under investigation).
- **Vector:** Physical Supply Chain Interception.
- **Details:** Attackers intercepted genuine Ledger devices at the reseller or distributor level to install unauthorized hardware components.
### Lateral Movement
- **N/A:** This was a physical hardware attack rather than a network-based lateral movement incident. The "movement" occurred via the distribution of compromised physical units to end-users.
### Data Exfiltration/Impact
- **Data Stolen:** 24-word recovery (seed) phrases.
- **Impact:** Total loss of cryptocurrency assets for affected users as attackers gained full access to private keys.
### Detection & Response
- **Detection:** Multiple users reported unexplained cryptocurrency losses, prompting an investigation by Ledger and third-party researchers (Mark Karpelès and Tibane Labs).
- **Response Actions:** Ledger’s "Donjon" security team analyzed the tampered devices; Ledger ordered a sales halt across multiple Asian markets; MediaMarkt pulled products in Europe.
## Attack Methodology
- **Initial Access:** Physical tampering of hardware wallets during the supply chain/distribution process.
- **Persistence:** A physical hardware implant (microcontroller) remained dormant inside the device casing.
- **Privilege Escalation:** By capturing the seed phrase, the attacker bypassed all device security protocols.
- **Defense Evasion:** The implant did not modify the Secure Element or the Ledger OS, allowing it to pass Ledger's standard "integrity self-checks."
- **Credential Access:** The microcontroller intercepted and decoded the 24-word recovery phrase during the wallet setup/restoration process.
- **Discovery:** N/A (Physical recon of supply chain logistics).
- **Lateral Movement:** N/A.
- **Collection:** Automated capture of the recovery phrase by the implant.
- **Exfiltration:** Data was transmitted to the attacker via an integrated eSIM over an LTE cellular connection.
- **Impact:** Unauthorized transfer of funds from user wallets.
## Impact Assessment
- **Financial:** Significant, but total volume of stolen cryptocurrency is currently undisclosed.
- **Data Breach:** Compromise of private recovery seeds (the "master keys" to user funds).
- **Operational:** Suspension of sales across entire geographical regions; termination of reseller agreements.
- **Reputational:** High; trust in "authorized resellers" has been severely diminished.
## Indicators of Compromise
- **Network:** Unexpected LTE/Cellular traffic originating from a location where a hardware wallet is being set up.
- **File:** N/A (Hardware-based).
- **Behavioral:** Physical signs of tampering on device packaging or casing (though potentially professional enough to be invisible to laymen); unauthorized fund transfers shortly after device setup.
## Response Actions
- **Containment:** Ledger ordered all resellers in SE Asia and Hong Kong to remove products from shelves.
- **Eradication:** Ledger is investigating the extent of the tampering to identify all compromised batches.
- **Recovery:** Trezor (competitor) announced a reduction in reseller networks and updated legal frameworks to prevent similar incidents.
## Lessons Learned
- **Key Takeaways:** Software integrity checks (attestation) are insufficient if they only verify the Secure Element and OS, leaving the physical chassis vulnerable to "man-in-the-middle" hardware implants.
- **Gaps:** The reliance on third-party resellers creates a "blind spot" in the chain of custody for high-security hardware.
## Recommendations
- **Prevention:** Implement physical security seals that are harder to replicate; introduce secondary hardware integrity checks that scan for unauthorized radio frequency (RF) emissions.
- **Consumer Advice:** Users should only purchase devices directly from the manufacturer's official store until supply chain audits are complete.
- **Channel Security:** Manufacturers should implement stricter "Know Your Distributor" (KYD) protocols and perform random sampling/testing of stock held at reseller locations.