According to CoinMeta, on October 15, 2026, Ledger announced new security requirements for its authorized retailers due to a crypto theft incident. Attackers installed hidden electronic components in legitimate crypto wallets to steal users' mnemonic phrases and gain access to their funds. Ledger confirmed that the attackers purchased legitimate devices, modified them, and then re-sold them through distribution channels in Southeast Asia. The company has suspended resale sales in that region, inspected the devices in retail stores and warehouses, and began cooperating with law enforcement to track the stolen funds. Ledger stated that its internal systems, operating software, and security chips were not affected. Investigators are continuing to determine the full extent of the attack, including how the modified devices made their way onto the market. An investigation by Ledger found that the attackers spent months preparing for this operation, purchasing genuine hardware wallets, opening the devices, and inserting custom electronic components to capture mnemonic phrases during the setup process.