What Ledger Says — And What Is Still Unverified

Ledger's Oct. 15 account described a highly organized criminal group that spent months buying genuine devices, opening them, fitting custom hidden components, and returning them to distribution through resellers in Southeast Asia. 

Ledger called it a localized distribution attack rather than a systemic supply-chain attack, and said there was no flaw in its chip, operating system, or servers.

Ledger also tightened rules for its authorized network: returned devices must never be resold, products should no longer sit on open shelves or displays, and inventory should remain in controlled storage until purchase. 

It said it is working with law enforcement and that Donjon will examine devices it receives.

What remains unverified is just as important to state clearly: who tampered with the devices, at what point in the distribution chain, how many users were affected in total, how much was ultimately lost, and whether reports outside Southeast Asia are connected. 

Until Ledger or law enforcement confirms those points, they should stay labeled as reports and estimates — not settled facts.