The compromise of Ledger hardware wallets is turning out to be wider than first reported. Heise reports that the problem affecting manipulated devices — the case we covered on 10 October, in which wallets bought through resellers reached users with an unauthorised hardware implant and about $86 million drained from affected addresses — extends further than the initial disclosure indicated.
That matters because the shape of this failure is unusually hostile to the standard advice. Self-custody security model assumes the private key never leaves a device, and that a device you bought sealed is a device you can trust. This case collapses that assumption at the earliest possible point: not at the firmware, not at the seed phrase, but in the physical supply chain between the factory and the customer. There is no software update that retroactively makes a compromised board honest, and no alert that fires the first time a manipulated unit signs something it should not.
A broader footprint makes the practical questions sharper. How many units, through which channels, over which period? Can a user tell by inspection, or only by dismantling the device? And what does the manufacturer owe customers who are now expected to distrust hardware they were told was the point of the whole exercise?
The uncomfortable conclusion for the industry is not that hardware wallets are useless — a well-designed one remains a far better target than a browser extension. It is that the trust chain has moved downstream, past the cryptography and into retail, logistics and packaging, where almost nobody is auditing. Until that chain is verifiable end to end, "bought directly from the maker" is not a marketing preference. It is the security control.
