What Ledger's update confirms
Ledger says its Donjon security team dismantled the recovered implant and identified how it worked. According to the company, the added component was designed to capture a recovery phrase during the initial device setup. Anyone who obtains that phrase can restore the wallet elsewhere and access the funds, without compromising Ledger's service itself.
The update does not support treating every Ledger device as compromised. Ledger explicitly separates this case from a vulnerability in the Secure Element, its software, or its infrastructure. The confirmed scenario concerns devices that were physically modified after leaving the manufacturer's control, rather than a remote compromise of an ordinary wallet.
How Ledger defines the incident's scope
Ledger says the devices it knows to have been tampered with were distributed through resellers in Southeast Asia. It also spot-checked purchases from stores, including in Germany, and warehouse samples. The company says those inspected units were clean. Sampling is not a substitute for an examination of every device, but it matters when assessing broad claims of worldwide compromise.
The manufacturer asked authorised resellers and distributors to suspend sales in Southeast Asia and Hong Kong. It also says it is working with law enforcement and the security community. The public update describes an investigation and precautionary measures, but it does not identify the attackers, establish the number of affected devices, or quantify the total losses.
Why a physical supply-chain attack changes the threat model
The case highlights a limitation of familiar firmware and companion-app checks. A separate component already inside the casing may observe data displayed on the screen before a user ever signs a transaction. A successful authenticity check of the normal software therefore does not, on its own, prove that no additional hardware has been placed inside a device.
A suspected wallet should not be opened by its owner or used to enter a new recovery phrase. Opening the case can destroy evidence, complicate a support or law-enforcement report, and is not a reliable test for a typical user. The safer first step is to stop using the device and obtain guidance from official support.
Practical steps for device owners
For a device bought from a potentially affected seller that has not been set up, Ledger advises users not to initialise it and to contact support through the official website. Anyone with a used device that appears tampered with should stop entering recovery information, preserve purchase details, and seek official next steps. Material holdings call for a trusted new device and a newly generated recovery phrase only after the situation has been assessed through official channels.
For future purchases, use an official store or a verified authorised reseller, retain proof of purchase, and treat returns and display units carefully. Ledger has reminded partners that returned devices must never be resold, even when they appear new. These measures reduce the risk of physical tampering, but they are not a security guarantee.
