iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, a brand-new hardware wallet can be opened and modified before it reaches you. The attacker does not need to break the wallet’s cryptography. A hidden component installed after manufacture can capture the recovery phrase while you set up the device, then let the attacker restore that wallet elsewhere and sign transactions. The 2026 Ledger incident shows why an authentic device and a passed authenticity check are not the same thing as an untouched device.
The practical defenses are strict but straightforward: buy through an official channel, reject any wallet that arrives with a seed phrase or PIN, initialize it yourself, keep the phrase off every internet-connected device, verify addresses on the wallet’s own screen, and move funds immediately if the device’s chain of custody is doubtful.
What happened in the 2026 Ledger supply-chain incident
Ledger’s October 2026 incident response describes a localized distribution attack rather than a compromise of Ledger’s secure element, operating system, or servers. According to the company, criminals obtained genuine devices, opened them after they had left Ledger’s control, fitted custom components intended to capture recovery phrases during setup, and returned the devices to distribution through resellers in Southeast Asia.
Ledger says the event was not a compromise of its entire manufacturing system. Its wording was: “It was not a systemic supply chain attack.” That distinction matters: the attack was concentrated in a distribution channel, but a buyer receiving one of the modified units could still lose every asset controlled by the resulting recovery phrase.
#1 Best Overall
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
Tom’s Hardware reported that hundreds of wallets were drained and put losses at approximately $93 million. That figure is a 2026 media estimate, not a final audited total. Ledger confirmed coordinated draining but did not publish a final accounting, and no regulator or law-enforcement total had established a definitive number.
Ledger CEO Pascal Gauthier, quoted by Tom’s Hardware in 2026, described physical supply-chain tampering as “a risk for the whole industry.” The lesson applies to any hardware wallet: manufacturing controls lower risk, but they cannot guarantee that a genuine unit was never opened after it left the manufacturer.
How a modified wallet steals the recovery phrase
A hardware wallet is valuable because its private keys are supposed to remain inside the device. During first-time setup, however, the device must show or confirm a newly generated recovery phrase. That phrase is the master backup: anyone who obtains it can recreate the wallet on another device and authorize transfers without possessing the original hardware.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →1. A genuine device is acquired
The attacker starts with a real wallet rather than an obvious counterfeit. This helps the unit pass ordinary visual inspection and, in some cases, the manufacturer’s authenticity check.
2. The casing is opened after manufacture
The device is disassembled somewhere between the factory and the customer. The intervention can occur at a warehouse, during resale, or anywhere an intermediary has physical access. Re-sealing may leave visible clues, but careful work can make those clues difficult to notice.
3. A capture component is installed
The added hardware can observe the device display, electrical signals, or communication paths used while the wallet presents the recovery phrase. The objective is not to calculate a private key by defeating cryptography; it is to copy the phrase at the moment the user is creating or confirming it.
Rank #2
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
4. The wallet is returned to distribution
The modified unit is sold as if it were unused. It can retain the genuine secure element and normal exterior, so a buyer may see a familiar product and assume that authenticity has been established.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute5. The victim initializes the wallet
The customer follows the setup instructions, reads the phrase from the device, and writes it down. If the implant records the phrase, the attacker now has the wallet’s most important secret. A wallet that generated the phrase locally can therefore be compromised without ever having been “pre-seeded” at the factory.
6. The attacker restores and drains the accounts
Using the copied phrase, the attacker restores the wallet on another device or software wallet. They can then sign transactions that transfer the assets to addresses they control. The owner may notice only when a balance disappears or a transaction appears that they did not approve.
Why this attack does not require breaking the secure element
Secure elements are designed to resist extraction of keys and to perform signing internally. That protection is important, but it does not protect a phrase that a user is instructed to read during setup. If an implant captures the phrase before it becomes the wallet’s secret backup, the attacker can create an independent copy of the wallet without extracting anything from the secure element.
The same principle applies to malware on a computer or phone: software outside the wallet may alter an address shown on the host screen, but the wallet’s screen is the final place where you can verify what you are signing. Supply-chain implants and host malware attack different points in the process, so a safe setup must address both.
What authenticity checks can—and cannot—prove
Ledger Donjon explains that secure-element authentication helps detect a replacement or counterfeit component. That is valuable in an “evil-maid” or supply-chain scenario where a fake, backdoored device is substituted for the real one. The limitation is equally important: Ledger’s purchasing guidance says Genuine Check verifies the secure element but cannot detect unauthorized physical modifications when the original secure element remains intact.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
In practical terms, a passed Genuine Check is evidence that the authenticated component is genuine. It is not proof that nobody opened the wallet, added a recording circuit, or changed another part of the device. The 2026 incident was designed around that distinction.
There is historical precedent. Ledger Security Bulletin 002 described a malicious seller loading modified firmware onto a pre-seeded wallet. Tom’s Hardware also documented counterfeit operations in 2026 in which fake hardware and software exposed test PINs, seed phrases, or command-and-control credentials. These cases differ technically, but they share the same warning: never treat a seller’s setup, printed backup, or support instructions as trustworthy evidence.
How to check a wallet before you use it
Use the following checks before connecting a new wallet to an account or transferring funds to it. None of them proves an absolute negative, but together they reduce the most common distribution and setup risks.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Confirm the sales channel. Buy from the manufacturer’s own store or a reseller listed by the manufacturer. Trezor identifies its official shop, official Amazon storefront, and authorized resellers as approved routes; Ledger gives equivalent advice. An unofficial marketplace listing creates an additional custody handoff that you cannot independently verify.
- Inspect the package. Look for torn seals, adhesive residue, mismatched labels, opened screws, unusual gaps, or parts that do not match the published design. Packaging inspection is a warning system, not a cryptographic proof: a skillful reseal may leave little evidence.
- Reject any supplied phrase or PIN. A legitimate Ledger device never arrives with a preconfigured recovery phrase or PIN. Trezor generates its backup during setup and has no default seed. A card or screen showing words before you initialize the device is a stop signal, not a convenience.
- Check the device through the official application. Install only the official Ledger Wallet or Trezor Suite application from the manufacturer’s current distribution channel. Do not use a download link sent by a seller, a pop-up, a support chat, or an unsolicited email.
- Run authenticity and firmware checks. Let the official software perform its available device-authentication and firmware-verification steps. Record any warning rather than dismissing it; contact official support before proceeding.
- Examine the hardware itself. Compare ports, buttons, screws, screen, and casing with the manufacturer’s current documentation. Missing, replaced, or unexplained parts justify returning the unit.
Safe first-time setup
- Prepare a private environment. Set up where cameras, visitors, smart speakers, and screen-sharing software cannot observe the phrase. Disconnect remote-access tools and close unrelated applications.
- Connect only to the official wallet software. Follow the manufacturer’s setup flow and allow it to check firmware and device authenticity. If the application asks for the recovery phrase on the computer or phone, stop immediately; that is not a legitimate hardware-wallet setup step.
- Choose “create a new wallet.” Do not restore from a phrase supplied in the box, by a reseller, or by support. The device must generate the phrase during your own setup session.
- Write the phrase only on a private physical backup. Keep it off websites, cloud notes, password managers, messaging apps, photos, printers, and support forms. Never type it into a browser or computer. Anyone who sees it can recreate the wallet.
- Complete the device’s verification quiz or confirmation. This confirms that you recorded the words in the correct order without sending them to the host device.
- Test a small transaction first. Receive a small amount, then send a small amount while checking the destination on the wallet’s screen. A test does not prove the device is uncompromised, but it catches address-display and operational errors before a large transfer.
- Verify every important transaction on the device screen. Malware can replace an address or amount shown by the computer. Compare the full destination and amount on the wallet display before approving the signature.
- Store the backup separately from the wallet. The phrase should survive loss of the device but remain inaccessible to other people. Do not keep the wallet and its only backup together in an easily stolen location.
Choosing a replacement after a supply-chain concern
If a device may have come through the reseller channel associated with the 2026 incident, do not initialize it while you investigate. Contact the manufacturer through its official support site and preserve the packaging, order record, and photographs of any suspicious marks.
When selecting a replacement, compare the controls that matter rather than assuming a brand name eliminates risk.
| Control to compare | Questions to ask | Why it matters |
|---|---|---|
| Seller and chain of custody | Was the unit bought from the manufacturer or a currently listed authorized reseller? How many intermediaries handled it? | Each additional handoff creates another opportunity for opening, substitution, or resealing. |
| Device authentication | Does official software authenticate the secure element or otherwise check that the device is genuine? | Authentication reduces counterfeit and component-substitution risk, but does not prove that an intact genuine component was never surrounded by an implant. |
| Firmware verification | Does the setup software verify approved firmware and report unexpected changes? | Firmware checks can expose modified software, although they cannot detect every physical alteration. |
| Seed-generation workflow | Is the backup generated on the device during your setup, with no default seed or PIN? | A manufacturer- or reseller-supplied phrase is unsafe because someone else may already possess it. |
| Recovery usability | Can you restore the wallet using the documented process without entering the phrase into a host device? | A clear offline recovery path reduces the chance that support or malware will trick you into exposing the phrase. |
A Trezor Safe 3 can be considered as a replacement because Trezor documents an official Amazon storefront and a secure-element authentication process intended to confirm a genuine, unmodified device. That process lowers risk; it does not make the product immune to every supply-chain attack. A Ledger Nano S Plus can likewise be used when purchased through an official channel, provided you understand that Genuine Check does not detect every physical implant. Neither device should be described as mathematically immune to tampering.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
What to do if you suspect compromise
Before setup
Stop. Do not connect the wallet to a browser extension, create an account, or type any phrase that came with the package. Photograph the packaging and device, retain your receipt, and contact the manufacturer through its official support site. Request a replacement or return through the original seller only after confirming that the route is legitimate.
Free tools Windows power users keep installed
One-click scans. No signup required.
After setup but before funding
Do not use the wallet’s generated phrase for assets you care about. Wipe the device only if official support instructs you to; a reset does not prove that an unknown physical component has been removed. Obtain a trusted replacement and generate a completely new wallet there.
After funds have been deposited
Treat the phrase as exposed. From a trusted replacement device, create a new wallet and move the assets to newly generated addresses. Prioritize accounts holding the greatest value and monitor the old addresses for unauthorized activity. Do not reuse the suspected phrase, and do not rely on a firmware update as proof that a hardware implant is gone.
If a transaction is already unauthorized
Blockchain transfers generally cannot be reversed by the wallet manufacturer. Preserve transaction IDs, destination addresses, purchase records, and communications. Report the theft to the relevant exchange or custodian, your local law-enforcement or cybercrime reporting service, and the manufacturer’s security team. Avoid anyone who promises recovery in exchange for an upfront payment or asks for your recovery phrase.
The risk that remains after careful buying
Official stores and listed resellers reduce distribution risk but cannot eliminate it mathematically. A genuine device can still be opened after manufacture, and an authenticity check can miss an alteration that leaves the genuine secure element untouched. The strongest practical defense is therefore layered: trusted procurement, physical inspection, manufacturer checks, device-generated seed creation, absolute secrecy for the phrase, and screen-level transaction verification.
The recovery phrase remains the single most valuable secret in the process. If an attacker obtains it, the security properties of the original hardware no longer matter because the attacker can recreate the wallet elsewhere. Keeping that phrase private from setup through long-term storage is more important than any logo, seal, or “genuine” message on the screen.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
