In case you missed it, there's a fresh warning regarding one of the "official authorised resellers" of Ledger wallets going rogue and secretly installing microchips that would allow the perpetrators to steal private keys.
https://bt.irlbtc.com/view/5596402.0https://bt.irlbtc.com/view/5596352.0Short summary (if I get it right):
- a shop in Malaysia that was listed as an official authorised Ledger reseller, operated as such for years
- secretly they were adding spying microchips to every hardware wallet
- they would repackage wallets to make them look legit and untampered
- this allowed them to spy and steal bitcoins from unsuspecting victims
This topic is not meant to duplicate existing linked topics, but just wanted to use the Ledger example to spark some discussion about whether hardware wallets should be considered as safe in general and should they be recommended to new, less tech-savvy users.
This is not the first security incident relating to hardware wallets and not the first one relating to Ledger wallets.
Few other mentions:
- 2026 - Coldcard - flawed seed generation
- 2023 - Ledger Connect Kit supply-chain attack
- 2020 - Ledger - customer database breach
- 2019 - Trezor and KeepKey - physical seed extraction
I was always hesitant to use any hardware wallet as the means of holding any significant amounts. There's just too much trust involved. And even if you trust the owners of the manufacturing company, there are always some other risks, like rogue employees, any authorised partners, or even delivery companies.
Are there any steps a user can take to make sure his funds on a hardware wallet are truly safe, or should they only be used like mobile phone wallets - only for storing small amounts?
