Ledger’s Response to the Hardware Implant Attack

What Happened

A highly organized criminal group carried out one of the most sophisticated attacks our industry has seen. Over many months, they bought genuine Ledger devices, opened them, fitted custom-built hidden components designed to capture the recovery phrase during setup, and put them back into distribution through resellers in South East Asia.

They built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets.

There was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised. This was an attack on the distribution channel after the devices left our control.

To the users affected: we are with you.

How We Responded

We ran our largest investigation to date, involving every department in the company. Our security lab, the Ledger Donjon, took the implant apart and identified how it works. We followed every lead, including sending teams to local markets, including Germany, to spot buy and open a number of devices from stores, and we also examined samples from warehouses. Every unit examined was clean.

We asked Authorized Resellers and Distributors to suspend sales in Southeast Asia and Hong Kong. Out of an abundance of caution, we also screened our stock, checking large number of samples, and did not find any compromised units. We are working with law enforcement and the security community to follow the funds and dismantle the attackers’ infrastructure. We will publish more details in the future, and, when we can, give our industry peers a fuller technical disclosure so they can harden their own products.

Thank you to the Ledger teams who worked on this, to partners like SEAL_911 who stood with us relentlessly, and to those in our industry who behaved responsibly towards their users and towards us. Thank you also to our users for your patience and continued support.

This was not a systemic supply chain attack, it was a localized distribution attack. This attack was against our users and, let’s not kid ourselves, against the whole industry. What was under attack is not only our users and their funds. It was the right to digital private property, and the freedom that comes with it.

What We Are Doing Differently

Attacks evolve, and so must we.

We are tightening how our Authorized network handles Ledger devices. Today we sent our Authorized Resellers and Distributors a reminder of the rules that already apply to returned devices: they can never be resold in any form, even if they look new and unopened. We also requiring new steps, effective immediately, that include: Ledger products should no longer go on shelves or displays, and stock should stay in the back and be handed over at the time of purchase. They must also tell us promptly about any customer report of an unusual product.

We invite the whole industry to do the same. We are ready to share what we have learned with anyone who builds or sells hardware wallets, because this is bigger than any one company.

We have also been working on additional measures to thwart this kind of attack at the product level. Stay tuned.

Security has always been a race. This attack reminded us why why we lead with strong security defense, and we intend to keep leading it.

The Ledger Team