This is the third development in a story that has moved quickly since early October, so it is worth separating what is new here from what was already established.
Already reported: wallets bought through resellers have been compromised, roughly 86 million dollars has drained from affected holders, and the scale turned out to be wider than first reported. Those were the findings of our 10 October and 15 October coverage.
What Ledger adds now, in comments to the German security outlet heise, is intent and scale. The manufacturer describes an attack on "the whole industry", prepared over months with a budget in the millions. Heise's framing — "Verwanzte Wallets", roughly "bugged wallets" — keeps the emphasis on physical devices rather than a remote exploit.
Read together, that describes a supply-chain campaign rather than a single heist: money spent up front, time taken to place devices in distribution, and a target set broad enough that no single vendor's users are the point. For hardware-wallet holders that is the worst-case shape, because the product's only promise is that the key was generated on a device nobody tampered with — and the whole reason to buy one is to avoid trusting a website.
Still unresolved: how many devices and which brands are affected, where in the distribution chain the compromise happened, whether any retailer was complicit or merely exploited, and what recourse affected holders have. Ledger is the source for the "whole industry" characterisation, and a manufacturer describing the threat to its own category is not a disinterested one.
The practical advice does not change while those questions stand: buy only from the manufacturer or an authorised seller, generate the recovery phrase yourself on the device, never accept a pre-filled seed card, and verify firmware signatures before use.
