Two incidents, months apart, have forced a reckoning among bitcoin and crypto holders who assumed a hardware wallet removed the need to trust anyone. It does not, and the past year has shown exactly where the trust quietly hides.
On October 10, Ledger confirmed that some of its devices had been physically tampered with before ever reaching customers who later lost funds. The units in question were sold through an authorized reseller operating in Malaysia, Indonesia and the Philippines. That reseller had sold its business months earlier under a non-disclosure agreement, a detail that surfaced only after the damage was done. Ledger says the devices left its factory clean and were intercepted and altered somewhere along the supply chain before buyers opened the box.
The modification was precise: a microcontroller, an LTE cellular module and an e-SIM were soldered onto the board, designed to read the seed phrase as the user viewed it on screen and transmit it out. Ledger Live, the companion app meant to verify device authenticity, approved these units as genuine, because its cryptographic attestation checks the firmware code, not whatever circuitry has been added to the hardware itself. Bitquery estimated the resulting losses at 79 million USDT on Tron, 203.8 BTC, 1,230 ETH, and additional amounts in other assets.
The warning had arrived earlier than the theft. In April, six months before the attacks on users, hardware specialist Joe Grand disassembled a tampered Nano X bought in Thailand and notified Ledger directly. The company's response, once the scale of the problem became clear, was to order resellers to stop displaying devices on shelves, keep them in the back, and hand-deliver units to buyers. Ledger has not announced any compensation for the users who lost funds.
A separate flaw, a similar lesson
Coldcard's problem was not a physical implant but a firmware bug that, since 2021, had been generating seeds with far less entropy than the device promised, in some of the oldest affected models as little as roughly 40 bits rather than the expected 256. Coinkite, the company behind Coldcard, says it had reviewed the critical code with AI tools weeks before the attack and later submitted it to several advanced models for review. None of them caught the flaw. The resulting theft reached 1,719 BTC.
Nunchuk, a multisig wallet coordinator, noted that a compromised device of this kind transmits data the instant it is entered, leaving no window for the user to notice anything wrong. Zach Herbert of Foundation Devices pointed to a structural limitation across the industry: no manufacturer currently produces an encrypted screen controller, meaning the path between what a chip computes and what a user actually sees remains a point where trust is simply assumed.
Responses, old and new
Changpeng Zhao suggested a low-tech precaution: leaving a newly purchased device at rest for a couple of weeks before depositing meaningful funds, giving time for problems to surface. Luke Dashjr recommended, after the Coldcard case, supplementing device-generated entropy with precision casino dice as an independent source. Justin Sharp has since calculated the mathematics of that approach: even a visibly biased die, with one face landing 20% of the time, still yields about 2.55 bits of entropy per roll against 2.585 for a perfect die, enough to reach roughly 252 of the needed 256 bits across 99 rolls.
The open-source, DIY route has also gained attention. SeedSigner, built from a Raspberry Pi Zero, a camera and a screen that can be bought separately for under USD 50, was examined by a Universidad Autónoma de Barcelona study concluding in 2024 that it can be considered secure if used correctly, even without dedicated cryptographic components. A fork called Shield Signer goes further, adding generic smart cards that store seeds behind a PIN or sign transactions directly on the card. The scale gap between manufacturers is notable: Ledger reported selling more than 6 million units in 2024, while the Raspberry Pi board family has sold more than 77 million units according to results published in September 2026.
The underlying idea predates both incidents by two decades. Nick Szabo formulated it in 2001, in an essay titled "Trusted Third Parties are Security Holes," writing that "the best trusted third party is the one that doesn't exist." Not everyone has drawn the same conclusion from recent events. PlanB has said he does not regret shifting his bitcoin exposure to exchange-traded funds in 2025, trading the complications of self-custody for a different set of trusted intermediaries entirely.
