Ledger takes hardware wallets off open shelves
Ledger says opened spot checks, including in Germany, were clean. Resellers hand devices over at purchase.
Ledger published a statement on the hardware-implant attack on 15 October. An organized group spent months buying genuine devices and fitting hidden parts that capture the recovery phrase during setup, Ledger writes. The group put the devices back on sale through resellers in Southeast Asia.
The chip, the operating system, and Ledger’s servers were not compromised. The attack was on distribution, after the devices had left Ledger. Ledger says the group drained wallets.
Donjon took the implant apart. Teams also bought devices in German stores and opened them, and Ledger examined warehouse samples. Every device examined was clean, Ledger says.
Ledger asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales. Ledger’s own stock, checked across a large number of samples, showed no compromised units. Ledger calls the case a localized attack on distribution, not a systemic supply-chain attack.
Authorized resellers are to keep products off shelves and displays, effective immediately. Stock stays in the back and is handed over at purchase. Returned devices may never be resold, even if they look new and unopened.
Resellers must pass unusual customer reports to Ledger promptly. Ledger is working with law enforcement to follow the funds. The statement names SEAL 911 as a partner.
Ledger is working on further measures at the product level. The Atom report covers the device introduced the same day.
On 14 October Ledger published a Donjon update. That update says checked retail and distributor stock in Germany showed no tampering.
No implant-related loss of funds had been reported in Europe, the update says. Ledger invited the owner of the devices shown online to send them in for examination.
The CryptoBilis finding and MediaMarktSaturn’s withdrawal are in the 13 October report. Still open are the number of people affected, any loss total, and whether MediaMarktSaturn will stock Ledger again.
Sources
- Ledger — Statement, 15 October 2026 · Post, 15 October 2026, 1:00 p.m. Berlin
- Ledger Donjon — Germany update, 14 October 2026, 7:06 p.m. Berlin
- SOLANA·HUB — MediaMarkt and Ledger, 13 October 2026 · Ledger Atom