Ledger tightens reseller handling after physical wallet tampering

Ledger imposed tighter reseller handling rules in its 15 October 2026 response to a hardware-implant attack. Retail stock must stay off shelves and displays and be handed to a buyer only at purchase; the company also asked authorised resellers and distributors in Southeast Asia and Hong Kong to suspend sales.[1]

The company says criminals modified genuine devices after purchase and returned them to distribution, capturing recovery phrases during setup. It reports no compromise of its chips, operating system or servers. Those are Ledger’s investigation findings.[1]

Ledger said inspected retail and warehouse samples contained no compromised units. That result describes the samples examined; it does not establish the condition of every device already sold.[1]

A genuine chip and an intact device are separate checks

Ledger Donjon’s threat model describes a challenge-and-response process: a server asks the secure element to sign a challenge, then validates the signature and the device’s factory attestation. A successful result authenticates that secure element. The document explicitly says the check cannot detect an unauthorised physical modification, including a spying implant, if the original secure element remains intact.[2]

The operating implication is that cryptographic authentication and procurement controls answer different questions. One tests the chip’s identity; the other addresses what happened to the complete unit before it reached the person setting it up. A passed software check cannot substitute for that missing history.[2]

The financial estimate comes from a separate investigation

Bitquery’s investigation, updated on 16 October, estimates US$102.0 million taken from 335 wallets across six blockchains. Its method counts outflows from the wallets it identifies as victims, excludes later transfers between attacker wallets and values the assets at 9 October prices. Some EVM addresses appear on more than one chain, so the chain-level wallet counts are not additive.[4]

This is an attributed blockchain estimate, separate from Ledger’s physical-device findings. Bitquery says the transaction record cannot establish where every key leaked; wallet counts also do not identify the number of affected people. Its dated measurement provides scale without treating every traced loss as independently proven to involve the same hardware modification.[4]

The commercial control starts before wallet activation

Ledger’s purchasing guidance already said distribution agreements forbid restocking and resale of returned devices. The October response reiterates that rule, including products that appear unopened. The new handling requirement is to keep retail inventory away from customer-accessible shelves and displays.[3][1]

The purchasing guide also distinguishes a marketplace’s product page from its actual seller. Several vendors can appear on one listing, so the seller identity must be checked against Ledger’s authorised channels. It tells buyers not to use an opened or altered package and to contact Ledger Support.[3]

For a business buying devices for treasury or custody workflows, the useful procurement record therefore includes the seller, receipt, handling history and setup controls. These details help connect an affected unit to a supplier and the wallet it created; the purchase price alone says little about the operational exposure.[3]

For businesses distributing devices internally, a traceable handover before activation extends the same inventory control beyond the retailer.[2]

Report an error or submit an update