Ledger says it has tightened reseller controls after discovering that criminals opened genuine hardware wallets, inserted hidden components and returned the tampered devices to distribution channels. The company disclosed the changes on Oct. 15 as part of its response to an incident designed to steal users’ recovery phrases during setup.

According to Ledger, the implants were intended to capture seed phrases and give attackers access to customer funds. The company said its secure chips, operating system and backend servers were not compromised, framing the incident as a supply-chain and retail handling problem rather than a breach of Ledger’s core device infrastructure.

How the tampering worked

Ledger said the affected products were authentic devices that had been physically altered after leaving the company’s direct control. Criminals allegedly opened the wallets, added concealed components and then returned the units so they could re-enter normal sales channels.

The purpose of the modification, according to Ledger, was to intercept recovery phrases when users first configured the device. Those phrases are the backup credentials that can restore wallet access, so anyone obtaining them could potentially take control of the associated crypto assets.

Ledger’s immediate response

In response, Ledger said it requested a suspension of reseller sales in Southeast Asia and Hong Kong. It also prohibited the resale of returned devices and instructed retailers to keep stock away from shelves and display areas while additional checks were carried out.

The company added that devices sampled from stores and warehouses were found to be clean. That statement indicates Ledger did not report evidence that its broader inventory had been compromised, though it still moved to tighten handling rules around returns and third-party distribution.

What Ledger says was not affected

Ledger said the incident did not involve a compromise of its chips, operating system or servers. That distinction matters because it suggests the attack relied on physical interference with devices rather than a software intrusion into Ledger’s platform or manufacturing security.

The company’s account leaves the main risk centered on customers receiving tampered units through distribution channels. The approved measures therefore focus on limiting resale pathways for returned products and narrowing exposure in affected regional reseller networks.

Next steps and wider backdrop

Ledger’s announcement came in a week that also saw broader developments across crypto markets and infrastructure, including a brief drop in Bitcoin below $80,000 and new index-rule changes from MSCI affecting some digital asset treasury companies.

For this case, the next confirmed steps are operational rather than legal: reseller sales have been halted in Southeast Asia and Hong Kong, returned devices can no longer be resold, and retailers have been told to keep stock off shelves and away from displays. Ledger has also said its spot checks of store and warehouse inventory did not find compromised devices.

Source: crypto.news