Ledger will review its sales and anti-tamper policies after attackers stole $93 million through a supply chain attack on its hardware wallets. The figure, reported in the source coverage of the incident, makes this one of the largest confirmed losses tied to a hardware security product in recent memory.

What happened in the attack?

The attackers did not break Ledger's cryptography. They worked through the supply chain instead, compromising devices before they reached customers. The source report frames the incident as a supply chain attack, which means the integrity of the distribution path, not the wallet's secure element, failed first.

That distinction matters for any hardware vendor. A wallet can hold sound silicon and still lose customer funds if an intermediary can tamper with the device, its packaging, or its delivery route. The simple takeaway: the security of a hardware product is only as strong as the least trusted hand that touches it.

What will Ledger change?

According to the report, Ledger plans to review two areas:

• Sales policies — how devices move from the company to the buyer, and which channels are trusted.
• Anti-tamper policies — the physical and procedural safeguards that show whether a device was opened or altered before use.

The company has framed these steps as a review rather than a finished set of rules. In plain words, Ledger has promised to examine how it sells and ships devices, but the source material does not yet list specific new measures, dates, or partners.

Why the supply chain angle matters

Hardware wallets exist to remove trust from third parties. A supply chain attack turns that promise inside out, because the customer must trust every step between the factory and the doorstep. The $93 million loss shows the scale of damage when that trust is misplaced.

For semiconductor and device makers more broadly, the incident is a reminder that physical distribution is part of the threat model. Seals, serialized packaging, and verified channels are not marketing features; they are the last line of defense for products whose value depends on remaining unopened.

What comes next

The source report does not state a deadline for the policy review or name the parties behind the attack. What it does establish is the direction: tighter control over who sells Ledger devices and stronger evidence that a device arrived untouched. Whether those reviews produce concrete changes in how Ledger ships its wallets will determine how much the $93 million lesson actually costs the company going forward.

Editor's note: the source material available to Chip Dispatch for this item was limited to the headline facts above; this analysis adds no figures, quotes, or claims beyond what the source stated.