Ledger Attributes Supply Chain Attack to Organized Crime Group

The Attack and Ledger's Response

Ledger released a statement confirming a sophisticated supply chain attack that compromised certain hardware wallet shipments. The manufacturer attributed the operation to an organized crime group that spent millions executing the breach. In response, Ledger advised customers who received potentially affected devices to leave them uninitialized if unused, and to move assets from any already-set-up compromised wallets to new devices with newly generated recovery phrases.

What Users Should Do

The company's guidance targets two user groups: those who purchased but never activated their Ledger hardware wallets, and those who have already initialized devices. For the former, leaving devices unopened or uninitialized eliminates the primary attack vector. For existing users, the recommended mitigation is to set up a fresh device and transfer all holdings to addresses generated from a new recovery phrase, effectively abandoning any potentially compromised seed material.

Context of the Breach

The scope and technical details of the supply chain compromise remain limited in Ledger's public disclosures. The attribution to organized crime and the stated scale of spending distinguish this from typical theft-of-opportunity incidents, though neither Ledger nor independent researchers have published forensic evidence or specific indicators of compromise that would allow users to independently verify which shipments or serial number ranges were affected.