A hardware wallet can be genuine and still be unsafe. That is the uncomfortable finding at the center of an attack involving Ledger devices distributed through reseller channels in Southeast Asia.
The devices were authentic. The hardware inside them had been altered. And the attack was already present before the owner made a first transaction.
THE ATTACK HAPPENED BEFORE THE FIRST TRANSACTION
Hardware wallets are supposed to keep private keys away from internet-connected computers. But criminals targeted the device before its owner made a transaction. Ledger says attackers purchased genuine devices, opened them, installed concealed components and returned them to reseller distribution channels in Southeast Asia.
The implants reportedly captured the 24-word recovery phrase shown on the wallet's screen during setup and transmitted it using cellular connectivity. Anyone with that phrase can recreate the wallet and move its funds. No cryptographic breakthrough was required.
GENUINE DOES NOT MEAN UNALTERED
A counterfeit device impersonates a legitimate product. A tampered device begins as the real thing. That difference matters because a genuine-chip or firmware check may not detect additional unauthorized circuitry inside the enclosure.
Ledger says its chip, operating system, servers and direct sales channels were not compromised. The company calls this a localized distribution-channel attack, not a compromise of its manufacturing systems. The physical chain of custody became the security boundary.
THE REPORTED LOSSES
Independent investigators estimate losses of approximately $90 million, but published totals vary. Ledger has not confirmed a final loss figure or the full number of victims. The figures are estimates, not a completed audit.
The mechanism matters even without an exact total. A phrase intercepted once can enable theft later, without any further contact with the original wallet.
WHAT OWNERS SHOULD DO
Ledger advised people who purchased affected devices through CryptoBilis not to initialize unused wallets and to contact official support. Those who already initialized potentially compromised hardware should follow official guidance and move assets to a new wallet generated on trusted hardware with an entirely new recovery phrase.
Buying through the manufacturer or a verified authorized channel reduces some reseller risk but cannot guarantee immunity from every attack. Never use a prewritten recovery phrase or enter seed words into an unsolicited website. For long-term storage, a metal recovery-phrase backup with letter tiles ↗ offers a durable alternative to paper. It protects the physical backup, not against a compromised device capturing the phrase during setup.
AFFILIATE DISCLOSURE // As an Amazon Associate, ZeroTrace earns from qualifying purchases. This supports independent reporting at no additional cost to you.
THE PRIVACY IMPLICATION
Compromised recovery material can threaten more than balances. Depending on the protocol and wallet, it may expose addresses, account relationships or transaction history. Shielded transactions cannot compensate for compromised custody of the keys.
Privacy at the blockchain layer and security of the physical device are separate boundaries. Both matter.
SELF-CUSTODY STILL HAS A SUPPLY CHAIN
Self-custody reduces dependence on exchanges and other custodians. It does not eliminate trust. Some trust moves into hardware design, manufacturing, distribution and everyone who handles a device before it reaches its owner.
The blockchain can be uncompromised. The encryption can be sound. The device can be genuine. And the wallet can still betray its owner.
The weakest point was not the blockchain. It was the moment a recovery phrase appeared on a screen that unauthorized circuitry could observe. The keys were offline. The attack was already inside.