Ledger Orders Resellers to Keep Wallets Off Shelves After Implant Attack

Ledger has told the shops that sell its hardware wallets to take the devices off their shelves. In a blog post published at 6:48 a.m. ET on Oct. 15, the company said its Authorized Resellers and Distributors must now keep its products out of sight until a customer buys one, and report any customer complaint about an unusual device (source 1).

The new steps are "effective immediately," Ledger said. In its words: "Ledger products should no longer go on shelves or displays, and stock should stay in the back and be handed over at the time of purchase. They must also tell us promptly about any customer report of an unusual product" (source 1).

Ledger said it also sent sellers "a reminder of the rules that already apply to returned devices: they can never be resold in any form, even if they look new and unopened" (source 1). That rule is not new, by Ledger's account. The shelf, display and reporting steps are.

The changes follow an attack in which criminals tampered with Ledger devices before they reached buyers. Le Coin first reported the case on Oct. 11, when Ledger confirmed an implant in a device sold through the reseller CryptoBilis (Oct. 11 report), and on Oct. 14 reported that Ledger had pulled devices in seven Asian markets and found no tampering in German stock (Oct. 14 report).

Ledger's account of the attack

In the Oct. 15 post, Ledger describes "a highly organized criminal group" behind "one of the most sophisticated attacks our industry has seen" (source 1).

"Over many months, they bought genuine Ledger devices, opened them, fitted custom-built hidden components designed to capture the recovery phrase during setup, and put them back into distribution through resellers in South East Asia," the post says (source 1). The recovery phrase is the set of words that can restore a wallet, so anyone who captures it can move the funds.

Ledger says the group "built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures." It adds: "They were patient, they spent millions, and they struck in one coordinated operation, draining wallets" (source 1). Ledger does not say how many users were affected or how much was taken, and this piece does not give a figure.

The company says its own products were not at fault. "There was no flaw in Ledger's chip, operating system or servers. Ledger's systems were not compromised. This was an attack on the distribution channel after the devices left our control," the post says (source 1).

Ledger also describes the scale in its own terms. "This was not a systemic supply chain attack, it was a localized distribution attack," the post says (source 1). That framing is Ledger's. The post does not list which resellers or how many devices were involved.

What Ledger says it checked

Ledger says it ran "our largest investigation to date, involving every department in the company" (source 1). Its security lab, the Ledger Donjon, "took the implant apart and identified how it works," according to the post (source 1).

The company says it sent teams to local markets, "including Germany, to spot buy and open a number of devices from stores," and examined samples from warehouses. "Every unit examined was clean," Ledger says (source 1). It says it also screened its stock, "checking large number of samples, and did not find any compromised units" (source 1). Ledger does not give the number of devices it opened.

The post confirms the regional pause Le Coin reported on Oct. 14: "We asked Authorized Resellers and Distributors to suspend sales in Southeast Asia and Hong Kong," Ledger says (source 1).

Ledger says it is "working with law enforcement and the security community to follow the funds and dismantle the attackers' infrastructure" (source 1). It thanks the security group SEAL_911 by name. The post does not name any law-enforcement agency.

What comes next

Ledger says it "will publish more details in the future" and, when it can, give other companies "a fuller technical disclosure so they can harden their own products" (source 1). It invites "the whole industry to do the same" on seller handling, and says it is ready to share what it has learned "with anyone who builds or sells hardware wallets" (source 1).

On the devices themselves, the post says only: "We have also been working on additional measures to thwart this kind of attack at the product level. Stay tuned" (source 1). It does not describe those measures or say when they will arrive.

For buyers, the new rules change what a purchase looks like at an authorized store: the device comes from the stockroom at the time of sale rather than from a shelf or display (source 1). The post does not say how Ledger will check that sellers follow the rules, or what happens to sellers that do not.

Ledger published the post ahead of its Op3n event, where it later introduced a new device, Ledger Atom (sources 1, 2). Ledger says reservations for a Founders Edition take "a fully refundable $100 deposit" with "the special reserve price of $849," that the device is "still in development," that price "may change before launch," and that "the estimated delivery date is Q2 2027. It is an estimate, not a commitment, and may change" (source 2).

Sources

1. Ledger, "Ledger's Response to the Hardware Implant Attack," company blog, Oct. 15, 2026: https://www.ledger.com/blog-response-hardware-implant-attack
2. Ledger, "Introducing Ledger Atom," company blog, Oct. 15, 2026: https://www.ledger.com/blog-introducing-ledger-atom

Holding the Corner.

Not financial advice.