Ledger: Criminal gangs spent millions of dollars to carry out hardware implant attacks, which are part of local distribution channel attacks

Ledger released a report on the investigation of hardware implant attacks, stating that a highly organized criminal gang purchased genuine Ledger devices over several months, disassembled them, and implanted custom hidden components to steal users' recovery phrases when initializing the devices. They then resold the devices through Southeast Asian distributor channels.

The attackers invested millions of dollars to build infrastructure for collecting recovery phrases, asset transfers, and money laundering, coordinating actions to transfer victims' assets. Ledger emphasized that this incident was not caused by vulnerabilities in the chip, operating system, or servers, but rather a localized distribution channel attack that occurred after the devices left the company's control. Currently, Ledger has requested authorized distributors and resellers in Southeast Asia and Hong Kong to suspend sales and conduct random checks on inventory and retail channel devices, finding no other tampered devices.

Additionally, Ledger has requested authorized distributors not to resell any returned devices, even if the packaging is intact; they have also immediately prohibited displaying products on shelves or in display areas, requiring devices to be stored at the back of the store and delivered upon purchase. The company is working with law enforcement and the security community to track the stolen funds and will disclose more technical details in the future.