In October 2026 Ledger devices sold by a reseller in Southeast Asia turned out to carry a hidden implant that read the recovery phrase off the screen — and still passed Ledger's own authenticity check. An estimated $86–95M was drained. You cannot X-ray your wallet at home, but you can make tampering very unlikely and very costly to the attacker. Here is a checklist built from the manufacturers' own guidance.
For years the honest answer to "can a hardware wallet be tampered with?" was: in theory, but nobody loses money that way. That changed on October 9, 2026. Hundreds of wallets were drained at once, and Ledger confirmed an unauthorized hardware implant in a victim's device. Every confirmed case traces back to CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Photos of one Ledger Stax show a cellular modem, a second chip and a hidden antenna wired inside the case. The secure chip itself was left alone — which is exactly why Ledger's Genuine Check passed. Ledger's own guidance now says it plainly: the check detects counterfeits but cannot detect physical modifications, such as implants, if the original secure element is intact. (Full story of the incident.)
The good news: an implant like this needs two things from you — a device that passed through the wrong hands, and you writing down a recovery phrase it can see. You can control both.
Every pair of hands between the factory and you is a chance to open the box. The fewer, the better.
Best: the manufacturer's own store. Ledger at shop.ledger.com, Trezor at trezor.io, Tangem at tangem.com. It can mean a few days of shipping and, in some countries, import duties — that is the price of the shortest chain. Acceptable: an authorized reseller you can verify on the maker's official reseller list. On Amazon, Shopee or Lazada, Ledger itself advises checking that the "Sold by" name is the official brand store or an authorized reseller. But remember that CryptoBilis was authorized; "authorized" lowers the risk, it does not remove it. Never: second-hand, "open box", returned, gifted by a stranger, or noticeably cheaper than the official price. A discount on a hardware wallet is a red flag, not a deal. Ledger's distribution agreements forbid resellers from restocking returned devices — so a "like new" unit is exactly what you should not buy.
One more trap at this stage: fake setup and shop pages. While researching this article, several of our search results for Ledger setup and support pages were look-alike pages hosted on free website builders. Type the address yourself or use our links — they go to the official stores.
Packaging. The box and its wrapping should be intact, without cuts, re-glued flaps or signs of resealing. Ledger's rule: if the package looks opened, altered or compromised, don't use the device and contact Ledger Support — even if it came from an authorized reseller or Amazon.
Seals, where the brand uses them. On a Trezor Safe 3 a holographic seal sits over the USB-C port. It should be clean, firmly attached and free of tears or residue; peeling it leaves a "VOID" pattern by design. Trezor lists two genuine seal designs — the original and an updated one from April 2024 with a UKCA mark. A missing or damaged seal means: stop and contact Trezor Support. For Ledger, the official guidance focuses on intact packaging plus the electronic Genuine Check. Coldcard ships in a sealed tamper-evident bag: its setup guide says to look for torn seals, resealed areas or adhesive residue, to confirm that the serial number printed on the bag matches the device, and not to power the device on if the bag looks compromised.
Contents. The recovery sheet or backup cards must be completely blank. The device must not arrive with a PIN or recovery phrase already set. Ledger puts it bluntly: "A legitimate Ledger device never comes with a recovery phrase or PIN code pre-configured." A pre-printed "your recovery phrase" card is a known scam: whoever printed it controls the wallet. A Trezor Safe 3 ships without firmware — Trezor Suite installs it during setup — and Trezor says a device that already has firmware triggers a prompt asking whether you have used it before; if you haven't, treat it as compromised.
Download the companion app only from the official site or the official app stores: Ledger Wallet (formerly Ledger Live), Trezor Suite, the Tangem app. Never from a link in an email, a DM or a "support agent".
Run the official authenticity check and don't skip it. Ledger's Genuine Check challenges the device's secure element and verifies the signature against Ledger's servers. Trezor Suite checks the firmware signature on every connection, compares the firmware hash with the official release, makes the device mix in entropy from the app when you create a wallet, and on the Safe 3 and Safe 5 asks the secure element to sign a challenge with its device certificate. The Tangem app runs a cryptographic test that only a card made by Tangem with its original firmware can pass, and warns you if the card was activated before it reached you.
Create the recovery phrase on the device, in private, and never type it anywhere else — not into a computer, phone, website or "verification tool". This is the step the CryptoBilis implant attacked: it waited for the 24 words to appear on screen.
No single check covers everything. That is why the order of steps above matters.
| Check | Catches | Misses | Who does it |
|---|---|---|---|
| Buying direct | Tampering by resellers and other middlemen | Attacks at the factory or in transit | You |
| Packaging & seals | Casual opening, returned or repacked units | A careful professional reseal | You |
| Blank cards, no pre-set PIN | Pre-seeded wallet scams | Implants, which wait for your new phrase | You |
| Official authenticity check | Counterfeit devices, fake or modified firmware | Extra hardware added next to a genuine chip | The app |
| Small test transaction | Nothing technical — but limits what you can lose while you watch | An attacker who waits for a bigger balance | You |
| Multisig (2 brands) | A single compromised device can't move funds alone | More setup, more backups to manage | You |
Read the last column again: most of the protection is in your hands, before the software ever runs.
A price well below the official one. A seller who is not on the official reseller list. A box that looks opened, re-glued or re-wrapped. A torn, missing or residue-marked seal on a Trezor Safe 3. A recovery card with words already on it, or a device that already has a PIN. A "replacement device" you never asked for — Ledger says it never sends them unprompted. An app, website, email or caller asking you to enter or "verify" your recovery phrase. Any one of these is enough.
No. Opening the case can damage the device and may void the warranty, and most of us could not tell a genuine part from an added one. Weighing the device or comparing photos is not a reliable test either, and we know of no manufacturer that recommends it. Leave forensics to the researchers; put your effort into where you buy and how you set up.
Not set up yet: don't initialize it. Contact the manufacturer's support through its official website and ask the seller for a refund. Already set up: treat the recovery phrase as exposed. Buy a new device directly from the manufacturer, create a brand-new phrase on it, and move your funds there — start with the largest balances. Do not restore your old phrase on the new device; if the attacker has the words, the new hardware will not help. Then report it to the police; Ledger asks victims of the CryptoBilis case to do so and to contact support via support.ledger.com. Be wary of "support" accounts that contact you first — Ledger says it will never call you, DM you or ask for your 24-word recovery phrase.
Test small, then wait. Send a small amount, receive it, send it back out, and leave it for a few days before moving savings. It does not detect an implant, but it limits what you can lose while the device proves itself. Use multisig for life-changing sums. A 2-of-3 wallet with devices from two different brands means one compromised device — or one leaked phrase — cannot move your coins on its own. It is more work, so it is for amounts where that work is worth it. Tangem argues its seedless cards sidestep this attack entirely because no phrase is ever shown and there is no screen or wiring to tap; that holds for the seedless setup, while its optional seed-phrase backup shows the words on your phone instead.
The CryptoBilis case does not mean hardware wallets have failed — the secure chips held. It means the supply chain became the target. A wallet bought directly from the maker, opened by you, set up by you and checked by the official app is still far safer than leaving savings on an exchange. What changed is that "authorized reseller" and "Genuine Check passed" are no longer the whole answer. Buy direct, check the box, test small.
Official stores (affiliate links, direct from the manufacturer):
Ledger store → Trezor store → Tangem store (code HCI −10%) → Compare models & prices →
Transparency note: HomeCryptoInvest earns affiliate commissions from Ledger, Trezor and Tangem; the store links above are affiliate links to the manufacturers' official stores. That doesn't change the advice — which is the same for every brand. Sources: Ledger, "Best Practices To Securely Buy Your Ledger Signer" and Ledger Support statements (October 2026); Trezor, "Authenticate Trezor Safe 3" and "Trezor's Multi-Layer Defense Against Supply Chain Attacks"; Coldcard Mk5 setup guide; Tangem, "How to Set Up the Tangem Wallet With a Seed Phrase" and Tangem statement on X (October 2026); CoinDesk, CryptoSlate, Cryptoast. Not financial advice.