Ledger supply chain attack suspected of spreading to Europe, user reports hardware implant found in device from official reseller

PANews reported on October 11, citing Bitcoin News, that security researcher Johannes disclosed that a hardware wallet purchased by a user from an official European Ledger reseller was found to contain an unauthorized hardware implant several weeks after purchase. The device reportedly showed suspicious wiring not present in normal Ledger hardware, indicating it may have been physically tampered with before sale. Researchers said the implant appears to use an earlier design, while newer implant components may be hidden behind the screen, making detection more difficult.

Notably, no funds have been stolen from the device so far, and researchers said it is unclear whether the implant is faulty or whether the attacker is still waiting for more user devices to be compromised.

Previously, the CryptoBilis Ledger incident had already raised concerns about hardware wallet supply chain security. As suspected related cases have successively emerged in Asia, South America and Europe, market concerns over the scope of the supply chain attack have further intensified. In addition, researchers pointed out that Ledger's official Genuine Check software is mainly used to verify device authenticity, and may be unable to detect unauthorized physical hardware modifications when the original Secure Element has not been compromised.