An attack in the sales channel
On October 15, Ledger said criminals bought genuine devices and then added hidden components designed to capture the recovery phrase during setup. The company asked distributors and resellers to pause sales in parts of Southeast Asia and Hong Kong.
Ledger’s claims and what remains separate
Ledger says its own systems were not compromised and places the incident in resale and distribution. It also says examined units from stores and warehouses were not altered. Technical details and the full extent reported by media should not be conflated with what the company confirmed.
Why an implant is dangerous
A hardware wallet protects private keys, but users may need to initialise it with a recovery phrase. If a modified device captures that phrase, the risk applies to assets controlled by it. This is not an ordinary account password, and rotating credentials cannot make an exposed phrase secret again.
Buy and set up carefully
Prefer the manufacturer or an authorised reseller, reject a device if packaging or security features appear altered, and follow official instructions. Never enter a recovery phrase on an unknown website, form, message or app. If in doubt, stop setup and contact official support.
If you entered the recovery phrase
Treat it as compromised. From a trusted device, create a new wallet with a new phrase and transfer assets as soon as possible; check fees and network before a transaction. Never disclose the phrase, including to someone claiming to be support. Crypto transactions may be irreversible.
For associated accounts, see our secure team password-sharing guide. Soclyde’s role
Soclyde is designed for work-service passwords, not private keys or crypto recovery phrases. Keep those offline according to the manufacturer’s guidance. Soclyde can help secure exchange or email accounts separately with unique passwords.
