Yesterday, we covered the reports of modified Ledger hardware wallets, and today it seemed everyone was discussing them. The company has now commented on the situation — here is the update.
According to the company, an organised criminal group was behind the attack. Over several months, the attackers bought genuine Ledger devices, opened them and installed hidden modules designed to capture seed phrases.
The wallets were then returned to shops under various pretexts and put back on sale through authorised resellers. Ledger specifically mentioned its Malaysian partner, CryptoBilis.
The company claims the group had a fully developed operation, including logistics, software for collecting data and a scheme for laundering stolen funds. According to Ledger, “millions of dollars” were invested in preparing the attack.
The manufacturer also says its own systems, services and direct sales channel were not compromised.
To prevent further incidents, Ledger suspended sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.
The company also introduced new rules for distributors and resellers. Devices must be removed from display and kept in storage until they are handed directly to the customer at the time of purchase.
The reports of modified wallets have been under discussion for about a week. Ledger says its specialists bought a selection of devices from retail shops and opened them for inspection, as well as checking samples from warehouses. According to the company, none of the inspected units showed signs of tampering.
The checks also covered shops in Germany. Some wallet owners in the European Union had previously claimed that devices containing spyware modules designed to steal cryptocurrency had also been found there.
Ledger is therefore describing a scheme in which genuine devices were modified and returned to retail sale. At the same time, the company says it found no such modifications in the units it inspected itself.
Every channel in the catalogue is checked by the editors against one method: it is how we work out the rating, place a channel at a risk level and decide whether it belongs in Market Scam.