Ledger Finds Hardware Implants in Wallet Supply Chain

Ledger said it found custom hardware implants in at least one of its devices, part of a supply-chain attack in which tampered wallets distributed through third-party channels in Southeast Asia were used to steal cryptocurrency. The company said the implants were designed to capture recovery phrases during setup, while its secure element, BOLOS operating system and internal servers were not compromised. Ledger said it instructed authorized resellers and distributors across Southeast Asia and Hong Kong to suspend sales while the investigation continued. It also described new handling measures for retailers, including keeping devices off open shelves and not reselling returned units, even if they appear unused. The company said it traced every verified theft case to devices bought through CryptoBilis, a Southeast Asian reseller, and that its own direct sales channels remained secure. Ledger reported that samples it examined from retail stores and warehouses showed no signs of tampering. Those inspections do not establish that every device sold through third-party channels has been checked. The attack centered on recovery phrases, which can be used to restore access to a...