Ledger, the French manufacturer of cryptocurrency hardware wallets, said it had identified an unauthorized hardware implant in a device obtained from a reseller in the Southeast Asian market. The company stated that the incident appeared to be isolated to that single reseller, and it is reaching out to affected users as part of an ongoing investigation.
The potential losses from the tampering have been estimated at more than $86 million, according to the company. The investigation has been conducted with the involvement of security researcher Specter, though details of the implant's nature and method of installation have not yet been disclosed.
Ledger posted on social media that it was contacting users who may have been impacted, urging them to cooperate with the probe. The company has not named the reseller involved, nor has it specified how many devices may have been compromised. Industry observers note that supply-chain attacks on hardware wallets, while rare, can be particularly damaging because the devices are intended to provide robust security for storing cryptocurrency private keys.
The incident marks one of the most significant hardware-level security breaches in the crypto storage sector. Ledger has previously faced scrutiny over software vulnerabilities and phishing attacks, but a confirmed hardware implant represents a more fundamental compromise of the device's trust model.