Ledger Hardware Wallet Supply-Chain Tampering Across Asia: Device Verification, Detection, and Procurement Hardening Guide

Ledger has instructed resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales of its hardware wallets and pull products from shelves while it investigates suspected device tampering in the distribution chain. This is not a software vulnerability with a patch — it is a physical supply-chain integrity event affecting one of the most widely deployed hardware wallet brands in the world, and it directly threatens any organization that holds, custodies, or transacts cryptocurrency using Ledger devices sourced through third-party channels.

If your organization — or your executives, treasury team, or high-net-worth clients — acquired Ledger devices through regional distributors, e-commerce marketplaces, or resellers in the affected markets, you must treat those devices as potentially compromised until proven genuine. Hardware wallets are the root of trust for private key custody. A tampered device can leak seed phrases, sign attacker-controlled transactions, or ship with a pre-generated, attacker-known seed. There is no antivirus scan that fixes a malicious hardware root of trust.

This post breaks down the attack model, how to detect counterfeit or trojanized companion software on corporate endpoints, how to audit device provenance, and the procurement controls that prevent recurrence.

Technical Analysis

What Happened

According to the reporting, Ledger proactively asked sellers across seven Asian markets to halt sales and remove devices from shelves while it investigates tampering. This pattern is consistent with a distribution-channel interdiction or substitution attack: devices are physically intercepted, modified, or swapped somewhere between the factory and the end customer — typically at the distributor, warehouse, logistics, or retail tier.

Affected Products and Channels

• Products: Ledger hardware wallet lines sold through retail/distribution channels in the affected region (e.g., Nano-series and Stax-class devices). Devices purchased directly from Ledger's official store are generally shipped through controlled logistics and are at materially lower risk — but any device that transited a third-party reseller in the named markets should be considered suspect.
• Channels: Authorized and gray-market resellers, distributors, and retail shelves in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong.
• Users at risk: Corporate treasury teams, exchanges and OTC desks, custodians, DAOs, and individuals who purchased through local retail rather than direct-from-vendor.

No CVE identifier has been published for this incident — this is a physical/supply-chain compromise, not a software flaw. Do not wait for a CVE to act.

How Supply-Chain Tampering of Hardware Wallets Works (Defender's View)

Hardware wallet tampering campaigns historically take one or more of these forms:

1. Device substitution / counterfeiting. The genuine unit is swapped for a look-alike device running attacker-controlled firmware. The fake device may generate seeds from an attacker-known entropy pool, meaning the adversary already holds the private keys before the victim deposits a single coin.
2. Pre-initialized device scam. The tampered package includes a "pre-filled" recovery sheet or instructions telling the user to restore from an included seed rather than generating a new one. Any seed that arrives in the box is, by definition, known to someone else.
3. Firmware/implant modification. The device is physically opened and modified (debug interfaces, secure element interposers, RF exfiltration implants). Ledger's architecture includes a Secure Element with genuine attestation checked by Ledger Live, which raises the bar for this class — but defenders should not assume attestation was verified by the end user. Most users click through setup without validating attestation results.
4. Companion software trojanization. The tampered package includes QR codes or URLs directing the user to download a fake "Ledger Live" installer that steals recovery phrases or clips/replaces wallet addresses. This is the most operationally common outcome and the one your SOC can actually detect on endpoints.

Exploitation Status

• Confirmed: Ledger has taken the extraordinary step of halting sales across seven markets — vendors do not burn distribution revenue over hypothetical risk. Treat tampering as confirmed at the distribution tier pending the investigation's findings.
• In-the-wild impact: Unknown at time of writing; the investigation is ongoing. Assume active risk for any device sourced through affected channels.
• CISA KEV: Not applicable (no CVE). This does not reduce severity.

Detection & Response

The most detectable artifact of this campaign class on corporate endpoints is trojanized or counterfeit Ledger companion software — fake Ledger Live installers delivered via QR codes, phishing, or bundled with tampered packaging — and the presence of Ledger-branded executables running from non-standard locations. The following detections are tuned to fire on those behaviors with minimal noise.

Sigma Rules

---
title: Ledger-Branded Executable Running From Non-Standard Path
id: 3f8a1c94-7b2e-4d51-9a06-2e7c5b8d4f1a
status: experimental
description: Detects execution of binaries named or branded as Ledger Live from paths outside the legitimate installation directories, consistent with trojanized companion software distributed via tampered hardware wallet packaging or phishing.
references:
  - https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/
  - https://attack.mitre.org/techniques/T1195/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|contains: 'ledger'
  selection_originalfilename:
    OriginalFileName|contains: 'ledger'
  filter_legitimate_paths:
    Image|startswith:
      - 'C:\Program Files\Ledger Live\'
      - 'C:\Program Files (x86)\Ledger Live\'
      - 'C:\Users\'
    Image|contains: '\AppData\Local\Programs\ledger-live\'
  condition: (selection_name or selection_originalfilename) and not filter_legitimate_paths
falsepositives:
  - Developers building Ledger-related tooling from source
  - Portable installations in non-standard directories (rare)
level: high
---
title: Download of Ledger-Branded Installer via Command-Line or Scripting Tool
id: 9c2e5d17-4a8f-4b63-8e1a-5d3b7f9c2e48
status: experimental
description: Detects command-line download utilities or scripting engines retrieving Ledger-branded installers, a delivery pattern associated with counterfeit companion software in supply-chain and phishing campaigns targeting hardware wallet users.
references:
  - https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
  selection_payload:
    CommandLine|contains:
      - 'ledger-live'
      - 'ledgerlive'
      - 'ledger_live'
      - 'ledger-setup'
      - 'ledgersetup'
  condition: selection_tools and selection_payload
falsepositives:
  - Automated software deployment of genuine Ledger Live via scripting (verify source URL points to ledger.com)
level: high

KQL — Microsoft Sentinel / Defender

The following hunt identifies Ledger-branded process executions outside legitimate install paths and correlates with network connections to non-official domains, which catches both trojanized companion software and phishing-delivered fakes:

// Hunt: Ledger-branded executables outside official install paths or talking to non-ledger.com infrastructure
let OfficialLedgerPaths = dynamic([@"C:\Program Files\Ledger Live\", @"\AppData\Local\Programs\ledger-live\"]);
let LedgerProc = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has "ledger" or ProcessVersionInfoOriginalFileName has "ledger"
| where not(FolderPath has_any (OfficialLedgerPaths))
| project DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, TimeGenerated, DeviceId;
LedgerProc;
// Correlate: network connections from ledger-named processes to non-official domains
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has "ledger" or InitiatingProcessCommandLine has "ledger"
| where RemoteUrl !has "ledger.com" and RemoteUrl !has "ledger.fr" and isnotempty(RemoteUrl)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc

Velociraptor VQL — Endpoint USB Provenance Hunt

Ledger devices present over USB with Vendor ID 0x2C97. The following artifact enumerates USB connection history from the registry to identify every endpoint where a Ledger device has been attached — essential for scoping which treasury/executive workstations have used wallets that may need integrity verification:

-- Hunt: Identify endpoints where Ledger hardware wallets (USB VID 2C97) have been connected
-- Scope corporate exposure to the Ledger supply-chain tampering campaign
LET usb_devices = SELECT
    FullPath AS RegistryPath,
    Mtime AS KeyLastWrite
FROM glob(
    globs="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\VID_2C97*\**",
    accessor="registry"
)
SELECT
    RegistryPath,
    KeyLastWrite,
    split(string=RegistryPath, sep="\\")[3] AS DeviceInstanceID
FROM usb_devices
GROUP BY DeviceInstanceID
ORDER BY KeyLastWrite DESC

Any hit on a workstation used for treasury operations or executive custody should trigger device attestation verification (below) and a provenance check on where that specific wallet was purchased.

Verification & Audit Script

Run this on Windows endpoints where Ledger Live is installed or Ledger devices are used. It validates the digital signature of the installed companion software and enumerates connected Ledger devices for the audit trail:

# Ledger Companion Software Integrity and Device Audit
# Run elevated on endpoints used for cryptocurrency custody operations

$report = @()

# 1. Locate and signature-check Ledger Live installations
$installPaths = @(
    "$env:ProgramFiles\Ledger Live\Ledger Live.exe",
    "${env:ProgramFiles(x86)}\Ledger Live\Ledger Live.exe",
    "$env:LOCALAPPDATA\Programs\ledger-live\Ledger Live.exe"
)

foreach ($path in $installPaths) {
    if (Test-Path $path) {
        $sig = Get-AuthenticodeSignature -FilePath $path
        $report += [PSCustomObject]@{
            Check        = 'LedgerLiveSignature'
            Path         = $path
            Status       = $sig.Status
            Signer       = $sig.SignerCertificate.Subject
            Verdict      = if ($sig.Status -eq 'Valid' -and $sig.SignerCertificate.Subject -match 'Ledger') { 'GENUINE' } else { 'SUSPICIOUS - INVESTIGATE' }
        }
    }
}

# 2. Hunt for ledger-branded executables in suspicious locations
$suspectPaths = @("$env:TEMP", "$env:APPDATA", "$env:USERPROFILE\Downloads", "$env:PUBLIC")
foreach ($dir in $suspectPaths) {
    Get-ChildItem -Path $dir -Recurse -Filter "*ledger*.exe" -ErrorAction SilentlyContinue | ForEach-Object {
        $sig = Get-AuthenticodeSignature -FilePath $_.FullName
        $report += [PSCustomObject]@{
            Check   = 'RogueInstallerHunt'
            Path    = $_.FullName
            Status  = $sig.Status
            Signer  = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'UNSIGNED' }
            Verdict = if ($sig.Status -ne 'Valid') { 'HIGH RISK - UNSIGNED/INVALID LEDGER BINARY' } else { 'Review signer' }
        }
    }
}

# 3. Enumerate connected Ledger devices (USB VID 2C97) for provenance audit
Get-PnpDevice -Class USB -ErrorAction SilentlyContinue |
    Where-Object { $_.DeviceID -match 'VID_2C97' } |
    ForEach-Object {
        $report += [PSCustomObject]@{
            Check   = 'LedgerDeviceConnected'
            Path    = $_.DeviceID
            Status  = $_.Status
            Signer  = $_.FriendlyName
            Verdict = 'Verify purchase provenance + run Genuine Check in Ledger Live'
        }
    }

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:USERPROFILE\Desktop\ledger-integrity-audit.csv" -NoTypeInformation
Write-Host "`nAudit complete. Any 'SUSPICIOUS' or 'HIGH RISK' verdicts require immediate IR escalation." -ForegroundColor Yellow

Remediation and Hardening

Immediate Actions (Next 24–72 Hours)

1. Inventory and quarantine. Identify every Ledger device in organizational use and its purchase source. Any device sourced from resellers, distributors, marketplaces, or retail in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, or Hong Kong — especially during the period under investigation — should be quarantined from further transactions pending verification.
2. Run genuine attestation. Connect quarantined devices to the official Ledger Live application only (downloaded directly from ledger.com, signature-verified) and complete the built-in Genuine Check, which performs Secure Element attestation against Ledger's servers. A failed or skipped attestation = treat the device as compromised.
3. Never accept a pre-generated seed. Any device that arrives with a pre-filled recovery sheet, or setup instructions directing you to "restore" rather than "set up as new device," is malicious by definition. Generate seeds on-device only.
4. Verify receive addresses on-device. Until provenance is confirmed, confirm every receive address on the hardware wallet's own screen — not the companion app — before transferring funds.
5. Rotate if in doubt. For any device that fails attestation, shows physical tampering signs (resealed packaging, mismatched holograms, opened anti-tamper seals), or has an unverifiable purchase chain: migrate funds to a freshly initialized, verified device with a new seed phrase. Treat the old seed as burned.

Procurement and Custody Controls (Structural)

• Buy direct only. Amend procurement policy: hardware security devices (wallets, HSM-adjacent tokens, FIDO keys) are purchased exclusively from the manufacturer's official store with documented chain of custody. No marketplaces, no local resellers, no "convenient" regional sourcing.
• Add devices to your asset inventory. Hardware wallets are security-critical assets. Track serials, purchase channels, custodians, and attestation status like you track certificates.
• Receiving inspection. Establish a documented acceptance procedure: packaging/seal inspection, attestation on first setup, companion software hash/signature verification before first use.
• Block counterfeit companion software at the perimeter. Deploy the Sigma/KQL detections above, and consider application control (WDAC/AppLocker) rules that permit Ledger Live only when signed by Ledger SAS and installed in approved paths.
• User awareness for custody holders. Executives and treasury staff are the highest-value targets for wallet phishing. Train them: Ledger (or any vendor) will never ask for a 24-word recovery phrase, and no legitimate packaging includes a pre-written seed.
• Monitor the investigation. Track Ledger's official advisories at ledger.com and the ongoing reporting at BleepingComputer for the investigation's findings, affected batch/serial information, and any formal recall or replacement program — then execute replacement against that guidance promptly.

If You Suspect Compromise

Treat a confirmed-tampered custody device as a security incident: freeze transactions from affected addresses, rotate keys to new verified devices, preserve the suspect device and packaging as forensic evidence (do not factory-reset), and review on-chain history for unauthorized outgoing transactions since first use. Report to Ledger support and, where losses occurred, to appropriate law enforcement (e.g., IC3, local cybercrime units).

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub