Ledger Tightens Reseller Rules After Hardware Wallet Hack

Hardware wallet manufacturer Ledger has introduced new security requirements for authorized retailers following an operation where attackers installed hidden electronic components inside genuine devices to steal recovery phrases. According to CryptoNews, the compromised hardware wallets were used in a coordinated theft operation on October 9.

Modified Devices and Hidden Implants

Ledger's investigation revealed that attackers purchased legitimate hardware wallets, opened the casings, and inserted custom electronic components designed to capture 24-word recovery phrases during setup. The hidden microcontrollers and embedded SIMs transmitted sensitive information through LTE cellular networks independently of the device's Secure Element. While independent blockchain investigators estimated losses exceeding $86 million, Ledger has not verified the total amount stolen or the number of affected customers.

Regional Suspensions and Retail Changes

Following the discovery, Ledger suspended authorized reseller sales across Southeast Asia and Hong Kong, covering Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. Resellers such as CryptoBilis and Germany's MediaMarkt Saturn halted sales after reports of affected customer devices. Ledger also ordered retailers to remove devices from display shelves and store them securely, prohibiting the resale of returned units without exception.

Key facts

• Ledger introduced new security requirements for authorized retailers on October 15, 2026.
• Attackers installed hidden microcontrollers and embedded SIMs inside genuine hardware wallets to capture recovery phrases.
• Reseller sales were suspended across Southeast Asia and Hong Kong.
• Ledger confirmed its internal systems, operating software, and security chips were not compromised.