Reports about wallet-draining by Ledger users. Total losses $86M+

[greysonz]

There is information about fake "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident:

https://x.com/SlowMist_Team/status/2110988183039332417

Slowmist warns that this fake email appears very credible: it features a fake page labeled "Verify Authenticity," along with a device selection and an "Update Now" button. An inexperienced user won't recognize this fake.
Therefore, a word of advice to anyone with a Ledger wallet: don't click on links from websites requesting updates.
Scammers are especially cunning, even given the widespread problem with spy chips.

[Wind_FURY]

Introducing...Ledger ATOM: Get the security of Ledger with the convenience of everyday apps. ALL-IN-ONE smart device.



Watch the introductory trailer here. ^{I'm pretty sure it'll be flooded with dislikes very soon. lol}

Who's buying?  

Are they gonna sell this themselves without relying on authorized resellers now?  

The people that leads Ledger's marketing team should learn to read the room. What a stupid decision to launch that now. They should keep investigating their supply chain.

But they probably did that because they know the company will close sooner or later when Trezor and their other competitors start to get their market share within the next two to three years.

[joker_josue]

But this time I replied that once you reach a considerable amount, it would be better to split it a bit between a Trezor, generate an offline seed using an old computer, and store it in a cold wallet, perhaps add a cell phone wallet...
Split it up to mitigate the risks a little

The idea is good in theory, but in practice it can get complicated.

Depending on the room and the amount of money you have, you might end up with many wallets to manage. So instead of worrying about two or three seed accounts, you have to manage the security of 10 or 20. It can be truly madness.

[greysonz]

It seems that by revealing the implantation scheme now, we have prevented the exponential growth of this phenomenon in the future.
According to Karpeles:

The  latest Ledger implant he examined is secured in place with snaps and is designed for "mass production," and he expects to see many more such implants in the future. Ledger claims that the products it tested in German stores showed no signs of tampering.

https://unchainedcrypto.com/mark-karpeles-says-ledger-spy-implant-turned-up-in-devices-from-2-more-authorized-resellers/

It turns out that the implantation scheme was optimized, and the criminals perfected the implant installation method. This sped up the process of creating compromised ledgers.

[LoyceV]

It turns out that the implantation scheme was optimized, and the criminals perfected the implant installation method. This sped up the process of creating compromised ledgers.

Once they master this, it looks easier than printing counterfeit money. And probably safer for the bad guys.

[nikola22]

It would have been refreshing if they'd own up to their mistakes. They're basically telling customers their device doesn't need protection because the device can tell you if it was compromised. That turned out to be a huge mistake.

they likely suspect that admitting their own mistakes would come at a high cost. at the very least, the total value of all the Bitcoins stolen from the wallets. claiming that a device requires no additional protection because it is already "tamper-proof" sets a precedent for legal action. I suspect that we’ll hear about lawsuits and the company will be forced to answer for this. did you notice that in their marketing for the new Atom device, they claim it features a new form of tamper protection? I wonder how many people will actually believe them after these incidents? )

Wait... that's it? We are with you... in what? spirit? Emotional support?  
I'm sure those users would want compensation for their losses; after all, Ledger is the one who endorsed that reseller on their website.  

for now it seems that the company is unwilling to offer users anything beyond moral support. compensations will likely be provided but only after users take legal action. as we can see, Ledger is currently refusing to acknowledge its mistakes and even promoting new devices, as if nothing serious has happened.

[Pmalek]

Ledger published a report about hardware implant attack:

A highly organized criminal group carried out one of the most sophisticated attacks our industry has seen. Over many months, they bought genuine Ledger devices, opened them, fitted custom-built hidden components designed to capture the recovery phrase during setup, and put them back into distribution through resellers in South East Asia.

They built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets.

There was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised. This was an attack on the distribution channel after the devices left our control.

also Ledger introduced new rules requiring authorized resellers to keep devices off display and hand them to customers at purchase:

We are tightening how our Authorized network handles Ledger devices. Today we sent our Authorized Resellers and Distributors a reminder of the rules that already apply to returned devices: they can never be resold in any form, even if they look new and unopened. We also requiring new steps, effective immediately, that include: Ledger products should no longer go on shelves or displays, and stock should stay in the back and be handed over at the time of purchase. They must also tell us promptly about any customer report of an unusual product.

https://www.ledger.com/blog-response-hardware-implant-attack

With Ledger's history of lying, I remain skeptical that they paid close attention or asked their resellers to keep an eye on returned products. I am pretty sure that whatever was returned went straight back into the store shelves after a very basic inspection to see if the devices are still physically intact. The part about them reminding resellers that returned hardware wallets shouldn't have been resold is just them saving face.

The rules have to change for hardware wallets and even big corporations like Amazon have to agree to it. Amazon allows you to return a product in a certain period of time without questions asked and get a refund. It's easy for scammers to manipulate devices and return them using official channels. That has to change.

[LoyceV]

I am pretty sure that whatever was returned went straight back into the store shelves after a very basic inspection to see if the devices are still physically intact.

Good point. I find it hard to believe they'd inspect devices by actually opening them and verifying the components.

The rules have to change for hardware wallets and even big corporations like Amazon have to agree to it. Amazon allows you to return a product in a certain period of time without questions asked and get a refund.

Here, that's a legal requirement for anything bought remotely.

[Wind_FURY]

People are starting to say that reports about tampering and implants were already sent to Ledger during late 2025, and during early 2026. I'm not sure of this is mere FUD or not, BUT if it's true, then the incompetence of Ledger has been shown/proven to the community.

Stop using your Ledger. That company doesn't deserve your support.

[Pmalek]

Here, that's a legal requirement for anything bought remotely.

I know. It creates big problems, though. Buyers must have the right to return products they don't like, those that haven't met their expectations, or don't work as advertised. But when it comes to hardware wallets, those can't simply be placed back into the inventory and resold to someone else. Optimally, they get shipped back to the manufacturers, where each unit gets inspected before evaluating if it can be resold or not. But I don't see that happening, so all this is pointless.

[LoyceV]

I know. It creates big problems, though. Buyers must have the right to return products they don't like, those that haven't met their expectations, or don't work as advertised. But when it comes to hardware wallets, those can't simply be placed back into the inventory and resold to someone else.

Simply put: that's the business risk of the webshop. Holding them liable if they resell returned and compromised devices can cost them much more than destroying a device. They could even use this as an opportunity to trace the ones tampering with devices. I expect only a very small percentage of legit users to return a hardware wallet. If those percentages suddenly go up, that's something to look into.
Or maybe the online shopping laws need to be updated: you're not allowed to return undies after trying them on, privacy related devices could use a similar exception.

[greysonz]

Stop using your Ledger. That company doesn't deserve your support.

Ledger management is further embarrassing itself by responding to Mark.


https://x.com/_pgauthier/status/2111460751449694354

What's wrong with Pascal? Karpeles spent so much time and effort on this incident, and he was the first to find the cause...

[nikola22]

With Ledger's history of lying, I remain skeptical that they paid close attention or asked their resellers to keep an eye on returned products. I am pretty sure that whatever was returned went straight back into the store shelves after a very basic inspection to see if the devices are still physically intact. The part about them reminding resellers that returned hardware wallets shouldn't have been resold is just them saving face.

The rules have to change for hardware wallets and even big corporations like Amazon have to agree to it. Amazon allows you to return a product in a certain period of time without questions asked and get a refund. It's easy for scammers to manipulate devices and return them using official channels. That has to change.

their policy supposedly states that returned devices cannot be resold, even if they look brand new and the packaging remains unopened. however, having a policy is one thing, enforcing it and ensuring fulfillment is quite another. I’m not even sure if the staff at these retail locations had the expertise to inspect a device and determine whether it had been tampered with or used. a logical approach would have been to send such returns to a centralized facility where they could be re-examined or disposed of but the company likely deemed that too costly.

ultimately, the company’s reputation can be summed up by this image:

[Wind_FURY]

Stop using your Ledger. That company doesn't deserve your support.

Ledger management is further embarrassing itself by responding to Mark.


https://x.com/_pgauthier/status/2111460751449694354

What's wrong with Pascal? Karpeles spent so much time and effort on this incident, and he was the first to find the cause...

Personally, there's nothing wrong with him in my opinion. It's a natural, emotional response because he's absolutely stressed, frustrated, and desperate because he truly knows that the company might not make it within two to three years.

To be frank, it might not make it out of 2027.

  ¯\_(ツ)_/¯

[greysonz]

Personally, there's nothing wrong with him in my opinion. It's a natural, emotional response because he's absolutely stressed, frustrated, and desperate because he truly knows that the company might not make it within two to three years.

To be frank, it might not make it out of 2027.

  ¯\_(ツ)_/¯

He needs not to worry and be sad, but to take action and have a plan.

Mark Karpeles is developing a low-cost device that can detect spy devices in Ledgers without opening the physical wallet:

Detecting a spy implant without cracking your device open is possible. I'm working on a device to make it cheap and easy, and will publish the PCB and specs so anyone will be able to build it.

https://x.com/BitcoinNewsCom/status/2111822808825127081

He's doing what the guys at Ledger should have done a few days ago.

[PrivacyG]

They're basically telling customers their device doesn't need protection because the device can tell you if it was compromised. That turned out to be a huge mistake.

That was such a prideful 'ours is better so no safety is necessary' card that uno reversed against them selves years later.  How expensive would that tampering sticker have been and other than the pride, why would they NOT include one?