Hardware wallets are widely seen as one of the safest ways to store crypto, because the private keys never leave the device. But a hardware wallet is only as trustworthy as the path it took to reach you. A major incident in October 2026 showed exactly why.
What happened
On October 9, 2026, a coordinated theft drained crypto from wallets set up on Ledger devices bought from CryptoBilis, a reseller in Southeast Asia. Ledger's security team, the Donjon, later found that some of these devices contained a hidden component inside the enclosure.
According to Ledger's investigation update, the implant read the 24-word recovery phrase from the device screen during setup and sent it to attackers over an LTE mobile network using an eSIM. Ledger said the implant did not modify the Secure Element chip, the operating system or transaction signing, which is why the device's own integrity checks could not detect it. Ledger described the event as a physical supply-chain attack, not a breach of its software or servers.
Onchain researchers estimated losses of up to about $93 million across more than 300 wallets, and Tether reportedly froze about $10 million in USDT linked to the theft. Ledger has not confirmed a total. The company asked authorized resellers in Southeast Asia and Hong Kong to suspend sales, and independent researchers have collected reports of tampered or counterfeit devices bought through other channels, including online marketplaces.
What a supply-chain attack is
A supply-chain attack targets a product somewhere between the manufacturer and the buyer. The device can be genuine, the software can be genuine, and the attack can still succeed because something was added or changed along the way. In this case, attackers bought real devices, opened them, fitted the implant and returned them to distribution.
The key lesson is that the most sensitive moment is setup, when the recovery phrase is created and shown. Anyone who sees that phrase can rebuild your wallet on another device and move your funds.
How to buy a hardware wallet more safely
- Buy directly from the manufacturer's official website whenever possible.
- If you use a reseller, confirm it on the manufacturer's official list of authorized sellers.
- Avoid marketplace listings, third-party sellers, auctions, flea markets and second-hand devices, even if they look sealed.
- Be suspicious of prices that are far below the official price.
- Never accept a device that comes with a recovery phrase already printed, filled in or "pre-configured."
How to check and set up the device
- Inspect the packaging and the device for signs of tampering, but remember that a careful attacker can make a device look new.
- Download the companion app only from the manufacturer's official website or app store listing.
- Run the manufacturer's genuine-device check during setup.
- Always generate a brand-new recovery phrase on the device yourself. Never import a phrase someone else gave you.
- Write the phrase on paper or metal and store it offline. Never photograph it, type it into a computer or phone, or store it in the cloud.
- Before moving large amounts, send a small test transaction and confirm you can see and control the funds.
What to do if you think your device is compromised
Ledger's guidance for affected buyers is a useful model for any hardware wallet:
- If you have not set up the device, do not set it up. Contact the manufacturer's official support.
- If you have already used it, move your assets promptly to a new wallet with a newly generated recovery phrase, created on a device you trust.
- Do not restore your existing recovery phrase on a suspicious device, because the old phrase may already be exposed.
- Revoke unused token approvals on any addresses linked to the old wallet.
- Report the incident to the manufacturer and, where relevant, to law enforcement.
Security habits that apply everywhere
No single tool removes all risk. Strong security comes from layers: a trusted device, a recovery phrase that never touches the internet, careful checks of addresses and amounts before you sign, and caution with links and messages that ask for your phrase. No legitimate support team, wallet provider or exchange will ever ask for your recovery phrase.
The same discipline applies when you trade. Whether you are moving funds to swap supported assets on AviorSwap, which lists 17+ networks, or to any other platform, double-check the network and address, start with a small test when using a new route, and keep your recovery phrase completely private.