When Hardware Can’t Be Trusted: The Ledger Supply Chain Attack
Software supply chain attacks have been a major cybersecurity concern for years. Compromised software libraries, malicious updates and tampered dependencies have shown just how easily attackers can exploit the systems we rely on.
But what about hardware?
We generally assume that when we purchase an electronic device, the components inside are exactly what the manufacturer intended. Sure, we might be cautious about the software running on it, but how often do we question whether somebody has physically modified the circuit board?
A recent attack involving Ledger cryptocurrency hardware wallets has demonstrated just how dangerous that assumption can be. And while the immediate target was cryptocurrency, an obvious target for malicious actors, the implications extend far beyond digital wallets.
What Happened to Ledger?
In October 2026, reports emerged of cryptocurrency being stolen from users of Ledger hardware wallets. These devices are designed to securely store the keys for access to digital assets such as Bitcoin. Instead of storing your keys on a computer which has a huge attack surface for potential key-stealing malware, hardware wallets are designed to securely store your keys on a separate device.
But in this case, the attackers didn’t need to break the encryption or hack the device’s firmware. Instead, genuine Ledger devices had been physically modified before reaching customers. Attackers reportedly obtained legitimate wallets, opened them, installed additional electronic components and reintroduced the modified devices into the retail distribution chain.
The added hardware was designed to intercept the wallet’s recovery phrase during initial setup and transmit it to the attackers using a cellular connection. With that recovery phrase, the attackers could reconstruct the wallets and steal the cryptocurrency stored in them. Independent investigators have estimated losses in the tens of millions of US dollars, with some reports exceeding US$100 million. The full extent of the attack remains under investigation.
Importantly, Ledger says its secure chips, operating system and internal infrastructure were not compromised. The confirmed attack involved tampering after devices had left its control, particularly through a reseller distribution channel in Southeast Asia.
A Tiny Circuit Board with a Big Impact
What the implant looked like.
What makes this attack interesting from an electronics engineering perspective is how it was implemented. The attackers didn’t replace the entire PCB or need to defeat its secure processor. Instead, they inserted a new circuit. By tapping into the display connections, the malicious circuit could observe information being sent to the screen. This allowed it to capture the recovery phrase as it was displayed to the user. The stolen information could then be transmitted using an embedded LTE module. The wallet still appears to work normally. Even legitimate hardware authentication checks could pass because the original secure element remained intact. That’s worrying!
The analysis
In his EEVblog analysis, Australian electronics engineer Dave Jones examines the hardware design, the additional circuitry and the physical security considerations involved. It’s a fascinating example of how relatively ordinary electronic components can be combined into a sophisticated attack.
A worthy watch. Dave Jones of EEVBlog discusses the Ledger attack.
Could Your Fridge Be Spying on You?
It sounds absurd, doesn’t it? You buy a new smart fridge, plug it in, connect it to Wi-Fi and suddenly somebody overseas knows you’ve been eating leftover pizza for three days.
Jokes aside, modern appliances increasingly contain powerful microcontrollers, networking capabilities, cameras, microphones and sensors.
There’s nothing inherently suspicious about those features. They’re used for legitimate functions like remote monitoring, fault diagnostics, temperature control and smart-home integration.
But they also expand the potential attack surface.
A malicious component introduced during manufacturing or distribution could, in principle, access sensor data, monitor internal communications or establish an unauthorised communication channel.
Of course, secretly monitoring the contents of somebody’s fridge is probably a questionable return on investment for a criminal organisation.
But the same principles applied to an industrial control system, telecommunications device or security product become considerably more serious.
Perhaps the bigger question isn’t whether your fridge is spying on you. It’s whether we’d even know if it was.
What’s the fix?
Ultimately manufactures are going to need to be closer to their supply chain and maintain traceability, verify distribution channels and have checks and balances in place to verify that what was ordered is what is being delivered. As a new story, I’m sure this topic will evolve and who knows, maybe there’s more supply chain attacks surviving in the wild we haven’t caught yet. Stay tuned.
