Ledger Tightens Retail Controls After Hardware Wallet Tampering

The malicious implants, discovered by Ledger’s Donjon security team, operated independently of the device’s secure element. By utilizing an embedded SIM to transmit recovery phrases via LTE during the initial setup process, criminals could drain accounts without altering the device's standard transaction signing functions. While independent investigators estimate losses exceeding $86 million, Ledger has not confirmed the total financial impact or the exact number of compromised units.

To prevent further exploitation, Ledger has issued a mandate requiring authorized retailers to remove devices from display shelves, moving stock to secure areas. The company has also enforced a strict no-resale policy for returned hardware, regardless of the product's condition. While Ledger maintains that its internal manufacturing systems remain secure, the company is now collaborating with law enforcement and the security collective SEAL_911 to trace the stolen assets and dismantle the criminal infrastructure used in the operation.