Ledger says criminals allegedly altered genuine hardware wallets by adding hidden electronics designed to capture recovery phrases. The company has tightened retailer rules and paused authorized reseller sales in parts of Southeast Asia and Hong Kong. The number of affected devices and the total value of any losses remain unconfirmed.
- Retailers must keep devices off display and never resell returns.
- Ledger says inspected samples contained no unauthorized components, but has not disclosed how many devices were checked.
- Independent investigators estimate losses exceeded $86 million, a figure Ledger has not verified.
How the alleged wallet tampering worked
In a technical update dated October 13, 2026, Ledger’s Donjon security team described an implant allegedly installed in genuine hardware wallets. The attackers reportedly opened the devices and added custom electronics, including a microcontroller and an embedded SIM. The component was said to capture a recovery phrase during setup and transmit it over an LTE cellular connection.
Ledger has not publicly explained exactly how the implant captured the phrase or identified the affected models. The company says the phrase was exposed during setup, but the technical information available does not establish precisely what the component monitored or how investigators verified the transmission method.
A recovery phrase is a set of words, often 12, 18 or 24, depending on the wallet, that can restore access to a wallet. Someone who obtains it may be able to derive the wallet’s private keys and control its funds. Switching to another device will not help if you use the same exposed phrase again.
Ledger said the incident involved a coordinated theft operation on October 9, 2026, and described it as a localized distribution attack. The company said its manufacturing systems were not compromised. It also said investigators found no evidence that the implant changed the wallet’s operating system or transaction signatures. The component operated independently of the Secure Element, a security component inside the device.
Those claims distinguish the alleged attack from a compromise of Ledger’s manufacturing systems or normal transaction signing process. The risk is still serious: a device could appear to work normally while a hidden component captures a recovery phrase during setup.
Ledger tightens retail handling rules
On October 15, 2026, Ledger announced new requirements for authorized retailers. Stores must remove devices from shelves and counters, keep them in storage and hand them to customers when they make a purchase. Retailers must promptly report unusual products or suspicious hardware.
Ledger also reiterated that retailers must never resell returned devices, even if they appear unopened or unused. The company said the prohibition was already in place. Its latest notice stressed that there are no exceptions.
Ledger paused authorized reseller sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong while it investigated. The information released does not say when the pause began or whether it remains in effect.
Ledger said it examined samples from stores and warehouses and screened some of its own inventory. It reported no unauthorized components in the samples checked, but did not disclose how many devices were examined, who selected them, or which models and sales channels the checks covered. The finding applies only to the samples examined and does not establish how widespread the alleged tampering may be.
In Germany, MediaMarkt Saturn stopped selling Ledger devices in physical stores and online after a customer device was reportedly found to contain an implant. Ledger said the case had not resulted in a confirmed loss of customer funds. The available information does not identify who confirmed the implant or when the German sales suspension began.
Ledger says it is working with law enforcement and security partners, including SEAL_911, to trace stolen funds and identify the infrastructure allegedly used to collect recovery phrases. The company has not disclosed any arrests, formal charges or recovered funds.
What customers should do, and what remains unknown
Ledger advised customers who used a potentially affected wallet to move their funds to a trusted device with a newly generated recovery phrase. Create the new phrase on the trusted device, then transfer the funds to addresses controlled by that new wallet. Restoring the old phrase on another device will not secure the funds if someone has already obtained it.
Never enter a recovery phrase on a website or share it with anyone claiming to be customer support. The information released does not identify affected serial numbers, models or purchase channels, so customers cannot check their devices against a published list. Anyone concerned should seek guidance through Ledger’s official channels without revealing their phrase.
Independent blockchain investigators have estimated losses exceeding $86 million. The available information does not specify their identities or calculation method, so the figure’s scope cannot be independently assessed here. Ledger has not verified the estimate or disclosed how many customers or devices may have been affected.
Investigators have not established exactly where every device was modified or how altered wallets re-entered distribution. Ledger says it is developing additional protections against physical tampering, but has not provided technical specifications, named affected models or given an implementation timetable. The company also says it plans to share further findings when investigators believe they can be released safely, and to share information with other hardware-wallet manufacturers and sellers.
Key questions and answers
-
What did the attackers allegedly do?
They reportedly added hidden electronics to genuine wallets to capture recovery phrases during setup and send them over an LTE connection. Ledger has not disclosed the affected models or the full technical details of how the phrase was captured.
-
Did Ledger confirm that inspected devices were compromised?
No. Ledger said it found no unauthorized components in the samples it examined, but did not disclose how many devices were checked or how representative the samples were.
-
How much was reportedly stolen?
Independent blockchain investigators estimate losses exceeded $86 million. Ledger has not verified the estimate, and the investigators’ calculation method is not specified here.
-
What should someone do if a recovery phrase may have been exposed?
Generate a new phrase on a trusted device and transfer funds to addresses controlled by that wallet. Do not reuse the old phrase or disclose any recovery phrase to a website or support representative.
