Key facts
- Ledger says attackers modified genuine devices before resale.
- The company requested sales suspensions in Southeast Asia and Hong Kong.
- Its response introduces stricter handling of reseller stock.
What Ledger reported
Ledger says criminals added components designed to capture recovery phrases during setup, then returned devices to reseller distribution. The company says its chip, operating system and servers were not compromised. These are Ledger's findings, not an independent security assessment.
The immediate changes
Ledger reiterated that returned devices must never be resold, even when apparently unopened. New instructions require stock to remain away from shelves and displays until purchase, with unusual-product reports escalated promptly.
The statement does not establish a verified total loss. It also does not provide a complete technical disclosure. The news is the response and distribution changes, rather than a claim that the investigation has concluded.
Primary sources
Reporting is based on the linked primary sources. Company statements are attributed to their authors; they are not independent test results.
Source links checked 16 Oct 2026
Understand the background
How to choose a hardware wallet: compatibility, backup and total costLedger vs Trezor: choose the device and recovery plan, not just the brandInformation to support your research. Not personal investment, tax or legal advice. Risk & disclaimer
