Ledger details response to hardware implants found in reseller-distributed devices
Ledger said genuine devices were physically modified after leaving its control, describing the incident as a localized distribution-channel attack rather than a compromise of its chip or servers.
Ledger published details about a hardware implant campaign affecting some genuine devices sold through resellers in Southeast Asia. According to the company, attackers acquired legitimate devices, opened them and installed hidden components designed to capture recovery information during setup before putting the devices back into distribution. Ledger said its chip, operating system and servers were not compromised and characterised the event as a localized distribution-channel attack. The incident is significant for the wider hardware-wallet sector because security does not end at firmware or cryptography; manufacturing, reseller controls, packaging and device provenance can also become attack surfaces. Avenor News reports the incident for security awareness and does not endorse any wallet vendor.