Ledger says a criminal group altered genuine hardware wallets and resold them through channels in Southeast Asia, turning devices meant to protect crypto holdings into tools for theft. The company said the attackers opened authentic products, inserted custom components and then put the wallets back into circulation.

Complaints linked to the devices began on Oct. 9, according to a Bloomberg report published Oct. 17. Blockchain researchers have estimated losses at more than $90 million. Ledger said in a statement on Oct. 15 that it is investigating with local law enforcement while asking sales and distribution partners in Southeast Asia and Hong Kong to suspend sales.

How the tampering worked

According to Ledger, the attack focused on the recovery phrase shown during a wallet’s initial setup. That phrase allows a user to restore access on another device if the original wallet is lost, making it one of the most sensitive pieces of information tied to a self-custodied crypto account.

The company said hidden hardware inserted into the modified wallets intercepted the phrase as it was sent to the screen, then transmitted it externally over a mobile communications network. With that phrase in hand, the attackers could restore the wallets elsewhere and drain the associated assets.

Ledger said the group also built a server to collect recovery phrases as well as separate infrastructure used to steal and launder funds. It described the operation as highly organized and said the altered devices had been obtained and modified over a period of several months.

Security protections were bypassed, not broken

Ledger said the attackers did not need to compromise the wallet’s secure chip directly. Instead, they used a separate component to read information being delivered to the screen, sidestepping protections built into the device’s core security architecture.

The company said its security chip, operating system and servers were not breached. Even so, the incident exposed a supply-chain weakness: a wallet with extra hidden parts could still pass existing authenticity checks if the genuine security chip continued to function normally.

That distinction matters for hardware wallet users because the case suggests that offline storage alone may not eliminate risk if devices are altered before they reach customers. The issue, as described by Ledger and outside researchers, sits in manufacturing, handling and resale rather than in a remote software intrusion.

Complaints spread across regional sales channels

Bloomberg reported that one retailer identified in the investigation, Malaysia-based CryptoVilis, suspended operations. A notice dated Oct. 10 at its Kuala Lumpur store said the location would close temporarily until further notice.

Suspected tampering was also reported in other channels. Ben York, who works in the crypto industry in Kuala Lumpur, said he noticed marks on the side of a Ledger Flex purchased at the MetaPod store in Singapore Changi Airport that appeared consistent with an attempt to force open the device.

York sent the wallet to Tibanne Labs, run by former Mt. Gox chief executive Mark Karpeles. Karpeles said he found a custom connector attached to the screen, along with a mobile communications chip and a SIM card. Ledger said it is reviewing tampering reports involving products bought from additional sellers as well.

Broader security lessons and the next steps

The case adds to a longer list of security failures around hardware-wallet ecosystems, though not all incidents involve the same type of risk. The source report noted earlier software flaws in Coinkite products that were estimated to have led to about $130 million in Bitcoin theft, while Trezor previously disclosed a leak of personal information affecting about 67,000 customers after an incident involving a delivery company.

Security specialists cited in the report said digital-asset protection depends on more than cryptography alone and that closing one attack path does not remove operational risks elsewhere in the chain. In this case, the weak point appears to have been physical access to devices before sale.

For now, Ledger says it has banned resale of returned products and tightened distribution controls so stores keep devices separately and hand them over only at the time of purchase. The company is continuing its investigation with local authorities, while the confirmed immediate step remains the sales suspension request covering official partners in Southeast Asia and Hong Kong.

Source: en.bloomingbit.io