Security concerns have arisen over the potential tampering of hardware wallets, devices designed to keep cryptocurrency private keys offline. Joe Grand, a hardware security researcher, told Cointelegraph that detecting sophisticated tampering is nearly impossible for average users, even for technical experts like himself. His expertise includes developing methods to bypass security protections in wallets made by Trezor and KeepKey.
The worries came to light after crypto losses were reported involving Ledger devices sold through CryptoBilis, an authorized reseller in Indonesia, Malaysia, and the Philippines. Ledger confirmed that one affected device contained an unauthorized implant that captured users’ recovery phrases and transmitted them over cellular networks.
Crypto analyst Mati Greenspan noted that hardware wallets introduce another chain of trust, from the manufacturer to the supplier, which can be vulnerable to tampering. Nick Neuman, CEO of Casa, pointed out that avoiding third-party trust entirely is impossible, suggesting users spread their risk across multiple providers.
Trezor, a competitor to Ledger, stated that its devices undergo authenticity checks and accept only signed firmware. However, these protections cannot rule out physical tampering. Trezor also noted that the implants found in Ledger devices pose a unique challenge as they capture information from the screen without modifying the firmware.
Grand suggested that physical design changes, such as transparent casings or tamper-resistant enclosures, could make supply-chain attacks more difficult. However, he cautioned that such measures should not be relied on alone. Trezor announced it would reduce the number of resellers as a preventive step.