Ledger published a report about hardware implant attack:
A highly organized criminal group carried out one of the most sophisticated attacks our industry has seen. Over many months, they bought genuine Ledger devices, opened them, fitted custom-built hidden components designed to capture the recovery phrase during setup, and put them back into distribution through resellers in South East Asia.
They built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets.
There was no flaw in Ledgers chip, operating system or servers. Ledgers systems were not compromised. This was an attack on the distribution channel after the devices left our control.
also Ledger introduced new rules requiring authorized resellers to keep devices off display and hand them to customers at purchase:
We are tightening how our Authorized network handles Ledger devices. Today we sent our Authorized Resellers and Distributors a reminder of the rules that already apply to returned devices: they can never be resold in any form, even if they look new and unopened. We also requiring new steps, effective immediately, that include: Ledger products should no longer go on shelves or displays, and stock should stay in the back and be handed over at the time of purchase. They must also tell us promptly about any customer report of an unusual product.
https://www.ledger.com/blog-response-hardware-implant-attackWith Ledger's history of lying, I remain skeptical that they paid close attention or asked their resellers to keep an eye on returned products. I am pretty sure that whatever was returned went straight back into the store shelves after a very basic inspection to see if the devices are still physically intact. The part about them reminding resellers that returned hardware wallets shouldn't have been resold is just them saving face.
The rules have to change for hardware wallets and even big corporations like Amazon have to agree to it. Amazon allows you to return a product in a certain period of time without questions asked and get a refund. It's easy for scammers to manipulate devices and return them using official channels. That has to change.
