Ledger Says Criminals Spent Millions on Wallet Theft Infrastructure

Ledger said a criminal group spent millions of dollars building infrastructure to collect recovery phrases, transfer assets and launder funds after implanting hidden components in genuine wallets sold through Southeast Asian dealers.

The group bought genuine Ledger devices over several months, dismantled them and installed hidden components designed to capture recovery phrases during setup, Ledger said. The devices were then resold through dealers in Southeast Asia. Ledger said the group built systems to collect phrases, transfer assets and launder funds, and coordinated transfers from victims.

Ledger asked authorized dealers and distributors in Southeast Asia and Hong Kong to suspend sales while it checks inventory and retail channels. The company said checks had found no other tampered devices. Retailers were told not to resell returned devices, even with intact packaging, and to keep wallets off shelves and displays until handing them to customers at purchase.

Ledger said the attack did not stem from flaws in its chip, operating system or servers. The company is working with law enforcement and the security community to trace stolen funds and plans to release more technical details.