Ledger said it has advanced its investigation into a hardware wallet supply-chain attack. According to Odaily, the company said an organized criminal group spent months buying genuine Ledger devices, opening them, and installing custom hardware designed to steal seed phrases before reselling the devices through Southeast Asian distribution channels.

Ledger said the group also built supporting systems for seed phrase collection, asset theft, and money laundering, and that the operation involved millions of dollars in spending. The company said the incident was limited to certain distribution channels and that its chips, operating system, and servers were not breached.

Ledger has asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales. It also introduced new security rules, including a ban on placing devices on shelves or display areas and a ban on reselling returned devices.