Ledger Reveals Hardware Implant Attack Targeting Seed Phrases

Ledger has disclosed details of a coordinated criminal operation that allegedly tampered with genuine hardware wallets to steal cryptocurrency users’ recovery phrases. The attackers modified devices before redistributing them through third-party channels in Southeast Asia. Ledger says its secure element chips, BOLOS operating system and internal servers were not compromised, describing the incident as a localized distribution attack. In its October 15 investigation update , Ledger said the group purchased genuine devices, opened them and installed custom-built components designed to capture recovery phrases during initial setup. The attackers then returned the modified wallets to distribution channels, allowing unsuspecting customers to use compromised hardware. Ledger said the operation also involved infrastructure built to collect recovery phrases, drain wallets and launder stolen funds.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to TronWeekly.