Ledger: Criminal group spent millions on hardware implant attack, a localized distribution channel attack

Odaily reports: Ledger has released an investigation report on the hardware implant attack, stating that a highly organized criminal group purchased genuine Ledger devices over several months, disassembled them to implant custom hidden components designed to steal users' recovery seed phrases during device initialization, and then resold them through distribution channels in Southeast Asia. The attackers invested millions of dollars to build infrastructure for seed phrase collection, asset transfer, and money laundering, and coordinated their efforts to move victims' assets.

Ledger emphasized that this incident was not caused by vulnerabilities in the chip, operating system, or servers, but rather was a localized distribution channel attack that occurred after the devices left the company's control. Currently, Ledger has asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales and conduct sample inspections of inventory and retail channel devices, and no other tampered devices have been found.

In addition, Ledger has required authorized resellers not to resell any returned devices, even if the packaging is intact; it has also immediately prohibited displaying products on shelves or in display areas, requiring devices to be stored at the back of the store and handed over at the time of purchase. The company is working with law enforcement agencies and the security community to trace the stolen funds and will disclose more technical details in the future.