A hardware wallet keeps your keys offline, but it cannot protect you from a device that was tampered with before it reached you. In October 2026, Ledger devices sold through the Southeast Asian reseller CryptoBilis were found to contain a hidden implant. It read the 24-word recovery phrase off the screen during setup and sent it to the attacker over a mobile network. On-chain investigators estimate losses of roughly $86 million to $93 million across hundreds of wallets. Ledger has not confirmed a total. CryptoBilis stopped selling Ledger devices, and Ledger later halted sales through its distributors in Southeast Asia and Hong Kong while it investigated.
The implant did not modify the secure chip, so the devices passed Ledger's own authenticity check. That makes the first rule the most important one.
Buy from the manufacturer or a listed reseller
Buy directly from the manufacturer's website or from a reseller on the manufacturer's official list of authorized resellers. Marketplaces, auction sites and unknown shops are a risk, even when the listing looks professional. A price well below retail is a warning sign, not a bargain. Some tampered devices were reportedly offered for close to half the normal price.
Never accept a device that is already set up
A genuine device arrives blank. It should ask you to choose your own PIN and generate a new recovery phrase. If it comes with a PIN, asks for a PIN you did not set, or includes a recovery sheet with words already printed or written on it, do not use it and do not send funds to it. No vendor will ever give you a recovery phrase.
Check the packaging, but don't rely on it
Look for signs that the box was opened or resealed, and for missing or unusual parts. Packaging can be copied or carefully resealed, however, so an intact box proves very little on its own.
Run the genuine-device check
Use the manufacturer's official app to run its authenticity check during setup. It confirms the secure chip is genuine, which rules out most counterfeits. As the CryptoBilis case shows, it cannot detect an extra component added inside the case. Treat it as a required step, not as proof that the device is clean.
Generate your own seed, on the device
Create the recovery phrase on the device itself and write it down only on paper. Never type it into a phone, computer or website. Never import a phrase someone else gave you.
Update firmware only through the official app
Install firmware updates only through the manufacturer's official app, downloaded from its official website. Ignore update links sent by email, messages or ads.
If in doubt
If you bought from an unlisted seller, or anything about the device seems off, do not set it up. If it already holds funds, move them to a new wallet with a new recovery phrase, created on a device bought from an official source. Then contact the manufacturer's support through its official website.