Ledger and Trezor warnings expose hardware-wallet supply-chain risks
A hardware wallet can be genuine and still be tampered with before it reaches its buyer. Ledger says an examined customer device contained an unauthorized implant designed to capture recovery words during setup. Trezor has separately warned about a reported device that its laboratory had not yet examined.
- Ledger confirmed an implant on an examined device; suspected losses remain estimates.
- Trezor’s Safe 5 report was credible enough to prompt a warning, but awaited lab examination.
- A copied recovery phrase can remain valid after a PIN change, reset, or device replacement.
- Hardware wallets protect keys, but cannot make every transaction safe to approve.
On November 10, 2026, Ledger CEO Pascal Gauthier told Bloomberg: “Everybody will be hacked at some point. Perfect security doesn’t exist.” He said that applied to Ledger and other companies.
It’s a useful antidote to claims of perfect security. But it doesn’t tell wallet owners what to do. They need to know what was exposed, what an attacker could access, and what steps might still limit the damage.
How a genuine device can be compromised
Ledger’s published response says attackers modified genuine devices after they had left the company’s control. The added components were designed to capture recovery words during setup. Ledger said it confirmed an unauthorized implant in an affected customer’s device.
That finding from a physical device is separate from blockchain researchers’ estimates of suspected losses. Information available as of November 11, 2026, does not confirm how many devices were affected or establish a final, verified loss amount.
A recovery phrase, also called a seed phrase or backup, can restore wallet access on another compatible device. Anyone who copies it may be able to recreate that access without unlocking or even possessing the original wallet. The device might appear to work normally while the owner’s backup is exposed.
This is a distribution-channel attack: tampering happens after a product leaves the manufacturer but before it reaches the buyer. An authenticity check may show that a device contains genuine components, but it may not detect added electronics. How a wallet reaches its owner is part of its security, not just a shipping detail.
Ledger says returned devices must never be resold. It has also described tighter stock handling and changes to retail rules meant to reduce opportunities to replace or alter displayed products. These steps address the device’s path to the customer. Whether they prevent future incidents remains to be seen.
Trezor’s warning is a separate, less conclusive report
On October 30, 2026, Trezor issued a notice about a Safe 5 purchased through CryptoBilis. The report described an added board between the device’s main board and screen, with a cellular component and antenna.
Trezor said it had received photographs and interviewed the person who reported the device, but had not yet examined it in its own laboratory. The company considered the report credible enough to warn affected buyers. It offered replacement hardware to eligible customers and advised them, where applicable, to create a new wallet with a new backup. As of November 11, 2026, the information reported included no laboratory results.
The evidence differs between the two cases. Ledger published findings from an examined device, while Trezor described a credible report that still awaited its own examination. The Trezor device was bought through CryptoBilis. That does not show that every device sold through the reseller was altered, or that the two cases involved the same operation.
A PIN does not cancel a copied recovery phrase
A PIN protects access to one physical device. A recovery phrase can restore the wallet elsewhere. If someone has copied the phrase, changing the PIN, resetting the device, or switching brands won’t invalidate that copy.
If your phrase may have been exposed, create a new wallet with a newly and independently generated recovery phrase on a trusted, clean device, then move the funds promptly. Don’t use hardware suspected of tampering to create the replacement wallet. A new PIN or a different backup format for the same wallet won’t help. The old phrase may still provide access.
Multisig, short for multi-signature, can require several keys to approve a transaction. But several devices restored from the same phrase are copies of one signing authority, not independent approvals. Multisig provides meaningful separation only when the keys are independent in practice.
A hardware wallet can still sign a harmful request
Not every wallet incident involves a stolen recovery phrase. An owner might also approve a transaction or permission that lets an attacker move assets. For example, a token approval can let a spender move tokens later. An account-permission change can alter who may act for an account or how many approvals are required.
Clear signing shows readable transaction details on the hardware wallet’s screen before approval. It can help owners check what they’re signing, but it doesn’t work for every transaction. Support depends on the network, the request, its metadata, and the software integration. Unsupported interactions may require blind signing: approving a request without being able to verify its full effect on the device.
Revoking a token approval may prevent future use if the owner still controls the account and acts in time. It cannot undo a completed transfer. If an attacker has the recovery phrase or other signing authority, they may be able to approve another action.
Some token contracts let an issuer freeze specified balances or restrict transfers from particular addresses. A freeze does not return funds to victims. Bitcoin’s protocol has no equivalent issuer-controlled freeze mechanism, though a custodian can restrict access to Bitcoin it holds for customers. Freezing tokens, restricting withdrawals at a custodian, and returning funds are different outcomes.
Comparing security claims requires comparable measures
Gauthier argued that losses discussed in his interview were smaller, relative to the assets protected, than those associated with a larger Binance theft. That is his comparison, not a verified like-for-like measurement.
A meaningful comparison would need to cover the same time period, define which assets count, and use a consistent method for attributing thefts. Exchange customer balances and estimates of assets held by hardware-wallet users describe different groups. Without a shared denominator, a loss-rate comparison can sound precise while measuring different things.
Wallet security: key questions and answers
-
Does changing my PIN protect a recovery phrase that was copied?
No. A PIN protects a particular device, not a backup held elsewhere. If your phrase may be exposed, create a new wallet on trusted, clean hardware and move the funds promptly.
-
Did Trezor confirm an implant in the reported Safe 5?
Not in the information available as of November 11, 2026. Trezor warned about a credible report but said it had not yet examined the device in its laboratory.
-
Can a hardware wallet prevent every harmful transaction?
No. It can protect a key and show readable details for supported requests, but some interactions are not fully displayed. Owners can still approve harmful actions.
-
Does freezing a token return stolen funds?
No. A freeze can restrict the movement of specified tokens. Returning funds requires a separate action.
-
Does using several hardware wallets create multisig?
Not if they use the same recovery phrase. Multisig requires distinct keys that meet a defined approval threshold.
For self-custody, check where your device came from, keep its recovery phrase private, and verify the details shown before approving a transaction. A hardware wallet is one layer of protection, not a substitute for securing the full process, from buying the device to protecting your backup and approving transactions.
