Ledger's Supply Chain Was the Exploit

An organized criminal group spent months tampering with genuine hardware wallets before Ledger ever knew what hit its distribution network.

By The crypto-money Desk

[1][2]

Onchain researchers estimate losses of up to $93M across more than 300 wallets, though Ledger has not confirmed the total. [1]

Ledger's security lab, the Ledger Donjon, took the implant apart and identified how it works. [2]

Authorized resellers and distributors across Southeast Asia and Hong Kong were asked to suspend sales. [2]

The distinction Ledger draws matters: the chips were fine, the code was fine, the servers were fine. What failed was the unglamorous machinery of physical distribution — the part of hardware security that no cryptographic proof can protect.

[2]

This was not a systemic supply chain attack, it was a localized distribution attack.Ledger