Ledger

E-commerce and marketing database breach discovered

Ledger discovered unauthorized access to its e-commerce and marketing database through a third-party API key; later publication of the stolen database exposed a much larger set of customer records.

Independent hardware research documented a physical implant inside a Ledger Nano X

Product: Ledger Nano X

Hardware security researcher Joe Grand publicly presented reverse-engineering research on a real-world Ledger Nano X unit modified with an additional physical hardware implant at hardwear.io USA 2026. The finding documents that a physically altered unit can exist independently of a vulnerability in Ledger's Secure Element or firmware. It does not establish how many devices were modified, whether a buyer suffered losses, or a link to later CryptoBilis-related reports.

Ledger disclosed Ethereum clear-signing array-count truncation vulnerability

Ledger disclosed an Ethereum app Generic Transaction Parser flaw in which an attacker-controlled 16-bit array element count was stored in an 8-bit countdown field. For a 257-element array, the device could review only one operation while its signature still authorized the complete transaction.

Ledger asks CryptoBilis reseller to pause device sales amid reported customer fund losses

Ledger Support said it was investigating reports of lost funds among Southeast Asian customers who purchased Ledger devices from reseller CryptoBilis. As a precaution pending its investigation, Ledger requested that CryptoBilis pause all Ledger device sales and shipments. Ledger advised customers who bought from the reseller within the previous 90 days not to initialize unused devices and advised those who had set up a device to consider moving their assets to a new Ledger signer with a newly generated seed.