To check if your hardware wallet is genuine, inspect the packaging, make sure no recovery phrase came pre-printed, and run the maker’s official authenticity check with software from the official site. If you bought a Ledger from the reseller CryptoBilis in the last 90 days, do not set it up at all.
Key Takeaways
- Ledger is investigating losses that one on-chain estimate puts above $86 million.
- The thefts are linked to devices sold by CryptoBilis, a reseller in Southeast Asia.
- Ledger says buyers from that reseller in the past 90 days should not set up their devices.
- If you already set one up, move funds to a new device with a brand-new seed.
- A genuine check confirms the secure chip, but it cannot detect every physical implant.
What happened with the CryptoBilis hardware wallets?
On Oct. 9, Ledger said it was investigating fund losses among users in Southeast Asia who bought devices from CryptoBilis. The reseller was listed as official in Indonesia, Malaysia and the Philippines, The Block reported.
Ledger asked the reseller to pause all sales. It also said no reports involved devices bought directly from Ledger, and that its own systems were not compromised. Separately, a researcher published photos of a device that he said hid LTE parts and an antenna behind the screen. Ledger has not confirmed that claim. We covered the theft itself in our CryptoBilis theft report.
How do you run a hardware wallet genuine check?
Work through these checks in order, and stop at the first red flag. Together, they are the simplest way to confirm a hardware wallet genuine status before you trust it with money.
1. Check where you bought it
To begin, buy only from the maker’s official store or a listed authorized reseller. Even then, this case shows that a reseller can be a weak point. Avoid marketplaces and second-hand sellers entirely.
2. Inspect the box and contents
First, look for torn seals, glue marks or a box that looks opened. Next, check the recovery sheet. It must be blank. A genuine device never ships with a pre-written recovery phrase, a scratch card or a preset PIN.
3. Confirm the device starts fresh
Similarly, a new device should ask you to set it up as new. If it is already set up, or it asks you to restore from a phrase in the box, do not use it.
4. Run the official Genuine Check
Ledger’s Genuine Check is a cryptographic test. It runs during setup and proves the device holds a real secure element. You can rerun it later under Settings, then Help, then Device Setup in the Ledger Wallet app.
However, only trust the result if the app came from the official website or the official app stores. Fake devices often ship with a modified app that always reports “genuine.”
5. Know the limits of the check
The Genuine Check confirms the secure chip. It cannot detect every extra part that someone adds to the hardware. That is why Ledger told affected buyers not to set up their devices at all, since setup is when the device shows your new seed phrase.
What should you do if you bought from CryptoBilis?
Follow Ledger’s guidance:
- Not set up yet: do not turn it on to create a wallet. Contact Ledger support.
- Already set up: buy a new device from an official channel. Create a brand-new seed, then move all funds to it.
- Never type your recovery phrase into a computer, phone or website.
Admittedly, moving funds to a fresh wallet costs a little in fees. Still, it is far cheaper than losing your savings. Our self-custody wallet setup guide walks through a safe setup step by step.
Why do supply chain attacks matter for everyone?
In short, the device is only as safe as the path it took to reach you. Attackers have learned that it can be easier to tamper with hardware in transit than to break the secure chip.
For most users, however, three habits cut the risk sharply. Buy direct, verify every device, and never use a seed phrase you did not generate yourself. Also, stay alert to fake “support” messages that ask for your phrase. Our guide on how to spot crypto scams covers the most common tricks.
Bottom line
A hardware wallet is still one of the safest ways to store crypto. But it only works if the device is genuine and the seed is yours alone. Take ten minutes today to check your device, and act quickly if anything looks wrong.
Disclaimer: This guide is for information only and is not financial or security advice. Always do your own research (DYOR) and follow your device maker’s official instructions.
