Security researcher Joe Grand notified Ledger on 04.03.2026 about implanted spy modules, while related images first appeared in August 2025.

Initial report and timeline

Joe Grand reported the presence of compact implant devices to Ledger on 04.03.2026, following earlier online posts from August 2025. Early public images showed small hardware additions that resembled third‑party modules, found initially with questionable online sellers.

Mechanism of the implants

The implant intercepted the wallet’s displayed recovery seed phrase during export and relayed it to attackers over a cellular network. The device did not require compromising the wallet’s secure element to capture the phrase, according to research notes shared with the manufacturer.

Ledger’s response and findings

Ledger acknowledged Grand’s report and said it would investigate the implants, later informing him that it had not found conclusive evidence of thefts via such modules. The company’s follow‑up extended the scope of the inquiry beyond gray‑market sellers to include some official resellers.

Scope and ongoing investigation

Subsequent probes shifted attention from isolated aftermarket sources to devices observed in supply chains involving authorized resellers. The development raises questions about hardware integrity and distribution controls for physical cryptocurrency wallets.