Ledger Says Criminals Altered Wallets to Steal Recovery Phrases

Ledger said criminals secretly modified genuine hardware wallets after buying them, then used the altered devices to capture recovery phrases during setup, prompting new sales controls across parts of Asia.

The company said the operation ran for months. The group bought authentic devices, opened them and installed a concealed custom component. The modified units then moved back into retail channels through distributors in Southeast Asia. Ledger said the group spent several million dollars and built servers to collect phrases, along with infrastructure for theft and money laundering.

Ledger said its chips, operating system and servers were not compromised. It placed the intrusion in the distribution chain, after the devices left its control. The company has asked authorized sellers in Southeast Asia and Hong Kong to pause sales. Effective immediately, products should not be displayed and should be handed over from inventory only when sold; returned units cannot be resold.

Ledger said spot checks of devices in Germany's retail market and its warehouses found no signs of tampering. The company is working with law enforcement and SEAL 911 to trace funds and plans to publish a full technical disclosure.