In 2021, a Ledger user posted a set of photos on social media. He had received a package containing a Ledger Nano X and an official-looking letter claiming that, because of a data breach, the company was sending him a "replacement device."
Suspicious, he opened the case and found an extra circuit board soldered onto the original board. According to several security outlets at the time, the add-on board could make the device show up as different hardware when plugged in, a way to trick users into running malware or entering their seed phrase.
For many people, it was the first time they realized that a hardware wallet itself can be the attack.
Key takeaways
- Tampered hardware wallets are real. Common methods include added circuit boards, swapped chips, modified firmware and pre-set seed phrases.
- Most come from unofficial channels: third-party sellers, second-hand marketplaces, cut-price resellers and unsolicited "replacement devices" sent by mail.
- Every genuine hardware wallet makes you generate the seed phrase on the device. A device that ships with a seed phrase card is compromised.
- Buying channel, unboxing checks and official authenticity verification: you need all three.
Where tampered hardware wallets come from
Attackers who tamper with hardware wallets want one thing: your seed phrase, or for you to use a wallet whose seed phrase they already know. Common methods include:
| Method | How it works | What the user experiences |
|---|---|---|
| Added circuit board | Extra chips or modules soldered onto the original board | The computer sees different hardware, luring the user into running malware or entering the seed phrase |
| Swapped chip and firmware | The original chip is replaced and modified firmware installed | The device looks normal, but the seed phrase it generates was prepared by the attacker |
| Pre-set seed phrase | A "ready-made" seed phrase card is included in the box | The user adopts those words and is robbed once funds arrive |
| Mailed "replacement device" | Leaked customer data is used to send modified devices posing as the company | The user thinks it's compensation, "restores" their wallet on it and leaks the seed phrase |
Beyond the 2021 case, Kaspersky analyzed a tampered counterfeit Trezor in 2023. It looked almost identical to the real thing, but its chip had been replaced and the seed phrases it generated were pre-set by the attacker. For more cases, read what recent hardware wallet incidents reveal.
Why attackers can find you so precisely
Modifying a device costs money, so attackers don't mail them at random. They usually work from a target list.
After Ledger's 2020 customer database leak, many users' names, phone numbers and shipping addresses became public. That list was effectively a directory of who holds crypto and where they live. In the years that followed, phishing emails, scam texts and even mailed fake devices were closely tied to that leak.
The other source is online marketplaces. Some third-party sellers offer hardware wallets below the official price, even advertising them as "pre-activated," "comes with a seed card" or "set up for you." The origins of these devices are usually untraceable.
How to tell whether your device is genuine
Work through this checklist:
| Step | What to do | Stop immediately if |
|---|---|---|
| Where you bought it | Buy only from the official site or authorized resellers | It came from a second-hand marketplace, cut-price reseller or unauthorized shop |
| Unsolicited shipments | Manufacturers don't send replacement devices unprompted | You never ordered it, yet a device arrived "from the company" |
| Packaging | Look for signs of opening or resealing | Broken seals, deformed packaging or missing accessories |
| First power-on | A genuine device asks you to set a PIN and generate a seed phrase | It's already activated or comes with a written seed phrase card |
| Official verification | Connect to the official app and run the authenticity check | The official app says the device failed verification |
| Software source | Download companion software only from the official site | Download links in a letter, text message or the packaging |
A few points deserve emphasis:
- A genuine device never ships with a pre-written seed phrase. If the box contains a card full of words, the device is fake.
- Manufacturers don't mail you new devices unprompted, and they never ask you to import your old seed phrase onto one.
- Major brands' companion apps include an authenticity check, in which the device's secure chip proves it was made by the manufacturer. Always run it with software downloaded from the official site.
Should ordinary users open their device to check?
We don't recommend it. Most users can't tell whether a circuit board has been modified, and opening the case may damage the device or void the warranty. Rather than opening the case, it's more effective to cut off the risk at the source: buy from official channels, check the packaging, verify with official software and generate the seed phrase yourself.
If you've already been using a device of unknown origin, the safest move is to buy a new one from an official source, generate a brand-new seed phrase on it and move your funds over. Don't import the old seed phrase onto the new device, because it may already be compromised.
FAQ
I bought my hardware wallet on an online marketplace. Can I still use it?
If it came from the brand's official store or an authorized reseller, it's usually fine, but still check the packaging and run the official authenticity check. If it came from an unknown third-party seller, was resold second-hand or was priced well below retail, don't store meaningful funds on it.
I received a "replacement device" from the company. What should I do?
Don't use it, and don't scan any QR codes or visit any web addresses in the package. Verify through the contact details published on the official website. If your personal data has leaked before, be extra careful and verify any "official" contact first.
If my device passes official verification, is it definitely safe?
Passing verification greatly reduces the risk of a counterfeit, but it only proves the device is genuine. You still need to protect your seed phrase, read transactions before signing and update firmware only through official software.
I suspect my device was tampered with and my funds are already on it. What now?
Buy a brand-new genuine device immediately, generate a fresh seed phrase and move your funds as soon as possible. Afterward, stop using both the old device and the old seed phrase. If funds have already been stolen, report it to the FBI's IC3 at ic3.gov or the FTC at ReportFraud.ftc.gov, or your local equivalent.
Summary
Tampered hardware wallets are a reminder that a security device's security starts the moment you place your order. Added circuit boards, swapped chips and pre-set seed phrases sound sophisticated, but the defenses are simple: buy from official channels, inspect the packaging, verify officially and generate your own seed phrase.
To decide whether a cold wallet is worth it at all, read is a cold wallet a waste of money? For the problem of seed phrase randomness, read a firmware bug hidden for years. This article is for education only and isn't investment advice.
Covers security and beginner guides: wallet safety, key management, phishing and approval risks, helping readers avoid the most common ways to lose funds.
Our editorial principles →
David Mitchell
Sarah Collins