Ledger Supply Chain Attack: How Seed Phrases Were Exposed

You buy a hardware wallet from a third-party reseller. You set it up. You move your crypto. And somewhere in that chain, an attacker already has what they need to empty your wallet. They do not need to touch the secure element inside the device.

Ledger has documented a supply-chain scenario involving physical access before seed generation and modified firmware. The described attack could simulate button presses to approve a transaction, but it could not extract the private keys or seed from the Secure Element.

This article explains how that path works, what controls reduce exposure, and what a hardware wallet genuinely cannot protect you from.

Understand the Threat Model

Self-custody means you, not an exchange, control the private keys. The wallet signs transactions locally and broadcasts them to the network. No intermediary holds your assets.

A hardware wallet takes this further by generating and storing private keys offline, then signing transactions internally without exposing those keys to the internet. Private-key isolation is the central security claim.

But keeping the signing chip separate is only one part of the picture. There are at least six distinct risk categories:

• Supply-chain risks: A device is tampered with or pre-configured before you receive it.
• Phishing and fake apps: You're tricked into entering credentials or a recovery phrase on a fraudulent site or app.
• Malware: Software on your phone or computer captures keystrokes, clipboard data, or wallet files.
• Malicious transaction approvals: You're deceived into signing a transaction that grants an attacker spending rights over your tokens.
• Physical access: Someone with physical possession of your device and access code can sign transactions.
• Recovery-backup risks: Your seed phrase is stored somewhere it can be found, photographed, or stolen.

Here's why this matters: a seed phrase is a 12- or 24-word backup that can regenerate all the private keys associated with a wallet. Anyone who possesses the seed phrase controls the funds. That makes it a completely separate attack surface from the signing device itself.

How the Attack Path Works

A standard hardware wallet setup works like this: the device generates entropy, converts it into a 12- or 24-word mnemonic using the BIP39 standard, and the user writes that mnemonic down as a backup. From that mnemonic, the wallet deterministically derives both public and private keys.

The recovery phrase is the exposure point. Modified firmware in the documented case could make a transaction appear approved by simulating button presses. The resulting risk is a deceptive approval that moves assets through a seemingly normal confirmation flow.

Ledger's Connect Kit incident in December 2023 illustrates a different but related supply-chain vector. Ledger detected the exploit on December 14, 2023, and attributed it to a phishing attack on a former employee's NPMJS account. Approximately five hours passed from compromise to full resolution, and some users signed transactions that drained their wallets during that window. The signing device itself was not compromised. The attack targeted the software layer connecting wallets to web applications.

These two scenarios share a structure: the secure element's isolation is intact, but the surrounding ecosystem creates an exposure path. That's the threat model worth understanding.

Controls that Reduce Exposure

The most effective controls address the specific paths above, not wallet security in general.

Before and during purchase:

Buy directly from the manufacturer's official store or a verified authorized reseller. Check that packaging seals are intact before opening. If a device arrives pre-configured with a seed phrase, treat it as compromised. A legitimate hardware wallet generates a new seed phrase during first setup, on-device. It does not arrive with one already written down.

At setup:

Never record your seed phrase digitally. No cloud backup, no phone photo, no notes app. Write it on durable physical media and store it in at least two physically separate locations. If you plan to move 100 USDT, test the recovery procedure before adding a larger balance.

Ongoing:

Keep wallet apps, operating systems, and browsers updated. Use strong unique passwords. Never share a recovery phrase with anyone, including support staff. Verify website addresses before entering credentials.

Separating a small spending balance in a hot wallet from the bulk of holdings in cold storage limits the impact of any single compromise. A hot wallet is suited to daily transactions and DeFi; cold storage is suited to long-term holdings.

After a suspected compromise:

Stop using the wallet immediately. Treat it as fully compromised. Migrate assets to a newly generated wallet using a device and recovery process verified through the manufacturer's official guidance. Do not disclose a recovery phrase or private key to support personnel or recovery services. Treat unsolicited recovery offers as potential scams.

For suspected firmware or seed-generation failure, physical tampering, or complex multisignature recovery, independent professional assistance may be appropriate. Use only official channels and independently verified advisors.

Limits and Trade-offs

Here's what a hardware wallet cannot protect you from.

• Phishing works regardless of the device. If you approve a transaction, the hardware wallet signs it. The device doesn't know whether you were deceived into approving it.

   

• Malicious approvals are a separate threat. A malicious token approval tricks you into signing permission for an attacker-controlled address to transfer your tokens later. It doesn't expose your private key. But it grants spending rights that can be exercised any time afterward. If a malicious approval allows an attacker to transfer 100 USDT, revoking the allowance afterward can prevent further transfers. It cannot return the 100 USDT.

   

• Recovery-backup exposure persists after setup. Written seed phrases can be lost, damaged, photographed, or stored in a single non-redundant location. The hardware wallet's security does not extend to the paper in your drawer.

   

• Self-custody shifts all responsibility to you. A lost device can be recovered if you have your seed phrase. Losing both the device and the seed phrase, with no alternative backup, leaves funds permanently inaccessible. There is no recovery process.

Cold-storage methods also differ in usability. Hardware wallets are portable but cost money. Paper wallets can be lost or damaged. Air-gapped devices add setup complexity. No method eliminates all risk. Each trades one set of exposures for another.

How Tangem's Design Reduces Specific Attack Vectors

Tangem takes a different approach to several of the risks described above, though it doesn't eliminate all of them.

The default seedless setup generates keys on-card and stores no seed phrase. This removes the recovery-phrase exposure path entirely. There is no mnemonic to intercept, photograph, or steal. A BIP39-compatible seed phrase remains optional for portability, but the default mode eliminates it as an attack surface.

The card itself has no USB port, no battery, and no Bluetooth. It connects by NFC only, with a 0-5 cm range, so signing requires physical possession and proximity. There's no screen to spoof and no cable to intercept.

The secure element and NFC antenna sit inside the card. Available source material for this article does not establish that they are sealed into it, so this detail should not be treated as a tamper-resistance guarantee.

Firmware is factory-installed and cannot be updated after production. This removes remote-exploit vectors that rely on malicious firmware updates. The hardware uses a Samsung S3D350A secure element certified at Common Criteria EAL6+, with independent audits by Kudelski Security in 2018, Riscure in 2023, and Cure53 in 2026.

The Tangem app performs a cryptographic authenticity check before operations, providing anti-counterfeit protection. The available material does not document an app warning if a card appears to have been activated before setup. If a setup state looks unexpected, stop and verify the device through Tangem's official guidance before moving funds.

But the remaining risks are real. Tangem's card has no independent display, so a compromised app or malicious dApp can show fraudulent transaction details without the card independently flagging them. Phishing, malicious approvals, wrong-address transfers, and user-approved transactions remain risks regardless of the hardware design. If all backup cards are lost and no seed phrase exists, funds are permanently inaccessible. Tangem cannot recover them.

The design choices reduce specific attack vectors. They don't remove the need for careful user behavior.