A hole punched by a distributor: A $100 liability cap cannot cover a $90 million loss

By Gu Yu, ChainCatcher

On the afternoon of October 13, Ledger issued its longest official update since the incident, detailing the attack methodology down to the component level: an implanted module hidden inside the device casing,"Read the data displayed on the screen"—During initialization, the device displays a 24-word mnemonic phrase on the screen. The module recognizes this interface, decodes it via the microcontroller, and transmits it over LTE using a pre-configured eSIM.

More critically, this was followed by a clarification:The implanted module is an independent component; it does not modify the secure element, the operating system, or alter any transactions or signatures.The chip is genuine, the system is original, and every transaction is confirmed by the user—the industry-standard checks taught to users were all passed by these devices. The only difference was that an extra pair of eyes saw the mnemonic phrase during the few seconds it appeared on the screen.

However, this update only addressed "what happened inside the device," failing to answer "what should those who lost funds do." Among the 164 replies, the most upvoted questions almost uniformly asked: Will Ledger assume liability and provide compensation for users who purchased tampered devices from authorized distributors and subsequently suffered financial losses? What recourse do users in the EU MediaMarkt channel have? Ledger’s stance is that all confirmed fund losses involve devices sold by CryptoBilis, while other channels remain "unverified."

Four days ago, this was merely an issue with "a specific distributor of a certain company"; now, it has become a question the entire hardware wallet industry must collectively address:From the moment a device leaves the factory, who exactly is responsible for its integrity?

On October 9, users in Southeast Asia reported concentrated incidents of asset transfers; on October 10, Ledger confirmed that one affected user’s device contained unauthorized hardware implants, marking the first acquisition of physical evidence. On the same day, CryptoBilis announced the suspension of sales and shipments of Ledger devices. An authorized distributor, a batch of affected users, and a severance of ties—the narrative thus far appears nearly complete.

However, in the following days, every new clue continued to stretch this framework.

The first anomaly lay with the devices themselves. To date, most of the confirmed tampered devices were brand-new units rather than returned items. The industry’s default risk model has long been: "customer buys new device → device is tampered with → device is returned → next customer falls victim." This pathway presupposes that tampering occurs after the sale. The fact that brand-new units had been compromised implies that tampering took place before the devices reached any user—shifting the problem from "a link in the distribution channel" to "a stage within the warehouse."

The second anomaly concerned the craftsmanship. Karpelès compared early samples with the latest ones in his blog: the former showed clear signs of manual modification, while the latter appeared to be produced on demand. If this observation holds, the tampering was not an impromptu act by an individual, but rather part of a supply chain capable of mass-producing implanted modules. Estimates along this chain have also been revised upward in tandem: Specter initially estimated losses at over $86 million, while Bitquery’s analysis on October 12, covering 324 wallets across multiple chains, put the figure at approximately $102 million. Meanwhile, Ledger has so far only stated: "We have not yet confirmed the total number of affected users or the total value of losses."

Then the clues began to cross borders. On the European front, a user named Johannes claimed to have purchased two tampered devices from two different MediaMarkt stores. He asked store employees to check inventory records, revealing that at least one unit came from Aqipa GmbH, a distributor covering all of Europe, suggesting the impact may extend far beyond Germany. On the Asian front, the device purchased by Karpelès from Amazon Japan was shipped by a Chinese seller and dispatched from Malaysia. Similarly, Nano X, a Japanese seller channel reported by research firm Tibane Labs, also shipped from Malaysia.Two clues, thousands of miles apart, pointed to the same shipping origin.

The other end of the chain was equally sophisticated. Tether froze $10 million in USDT on the first day; the attacker promptly swapped $15 million in USDT for USDD, which Tether could not freeze, and then converted it back into approximately $5.1 million in USDT, with about $4.23 million flowing into Binance deposit addresses. Additionally, 2,810 ETH were funneled into Tornado Cash in three batches. As of October 11, the attacker still held 15,475 ETH, 203 BTC, and $10 million in USDT. CZ proposed a more radical hypothesis—that the attacker had acquired the distributor and forced them to sign a non-disclosure agreement to ensure silence. While this claim remains unverified, the professionalism of the operation is evident.

Piecing these clues together, it is difficult to explain the incident as merely "sporadic":A bribed distributor constitutes an incident; a cross-border supply chain capable of mass tampering and evading asset freezes represents a systemic vulnerability. The former can be addressed by blacklisting entities, whereas the latter cannot. Ledger stated that it is developing more robust hardware anti-tampering measures but did not disclose specific details or a timeline for implementation. Its proposed self-inspection method involves users comparing component photos and disassembling the device themselves, while official tutorials simultaneously warn that opening the device may cause damage.The fact that verification requires users to disassemble the device themselves indicates that the industry has yet to find a definitive solution.

Beyond the incident itself, the differing responses from various manufacturers are even more informative. In fact, CryptoBilis not only sells Ledger products but also offers a wide range of hardware wallets, including Trezor, CoolWallet, Tangem, OneKey, SecuX, and Ellipal.

On the afternoon the incident broke, Keystone’s Chinese social media account posted promoting the PCI-level self-destruct feature upon disassembly in the Keystone 3 Pro: once physical dismantling or tampering is detected, chip data is automatically erased and the device is rendered invalid. This tweet garnered 42,000 views. It struck directly at the vulnerability of the current attack—implanting modules requires opening the casing, so self-destruction turns "silent installation" into "installed but nonexistent." However, choosing this timing also brought an awkward truth to light:The industry has actually possessed the technical solutions all along; it was just that no one previously considered them mandatory.

Most manufacturers’ initial reaction was to distance themselves. Trezor removed CryptoBilis from its authorized dealer list and halted sales through that channel, while also reminding users not to disassemble their devices. imKey stated that it had not received related feedback and would verify its authorized channels.

SafePal emphasized that its devices verify authenticity and usage status during initial setup, issue warnings for previously activated devices by displaying the first activation date, and use tamper-evident seals to identify if packaging has been opened. Tangem took a more thorough approach, making tampering architecturally impossible: the secure chip and NFC antenna are integrated and sealed, private keys are generated and signed within the chip, and the firmware written at the factory is immutable—"Regardless of whether users purchase through official stores, distributors, or other channels, as long as the app verifies the device as genuine, it ensures that private keys remain solely under user control."

However, Tangem’s statement precisely sidesteps the core issue:Verification: Can it prove its own authenticity?The fact is, Ledger's Genuine Check only verifies the authenticity of the secure element; it cannot detect any physical tampering with components surrounding the chip. Devices with implanted modules can still pass this authenticity check.No matter how tightly distribution channels are controlled, they can only reduce the probability of incidents, not eliminate the risk entirely.

In response to market skepticism, OneKey announced an unconditional free replacement for users who purchased through this channel since March of this year, without requiring the return of old devices. It also initiated a re-audit of all existing distributors, stating that 'authorization will be revoked for any entity whose operating主体 cannot be verified or whose ultimate beneficial owner is unclear,' and acknowledged that its 'distributor network will shrink significantly.'

After news of OneKey's free replacement program spread, the community began scrutinizing its User Agreement, which ironically triggered a major public relations crisis for OneKey itself.

Section 15.5 of the current Service Agreement states: If OneKey is found liable to users, its cumulative liability cap shall not exceed the highest of the following three amounts—(a) The actual purchase price of the device; (b) The fees actually paid by the user for the paid service within the 12 months preceding the incident; (c) One hundred US Dollars (USD 100). Furthermore, this is a 'single cumulative cap'; multiple claims, multiple incidents, or multiple legal bases will not increase this amount.

Section 15.4 is even more comprehensive: To the maximum extent permitted by applicable law, OneKey assumes no liability for loss or depreciation of any digital assets, regardless of the cause—the device and App are merely tools for managing keys and do not provide insurance or guarantees for assets. Section 15.6 provides the rationale: The App and most services are free, the device price does not include asset insurance, OneKey never holds users' assets or credentials, and does not know how much users have stored. Section 15.10 reserves a fallback option: OneKey may, at its sole discretion, provide compensation, replacements, or other assistance, butAny such measures are merely gestures of goodwill; they do not constitute an admission of liability, set no precedent, and create no obligations toward any party., and may require users to sign a disclaimer as a condition.

It is important to clarify that this is not unique to OneKey. OneKey’s official channels have previously noted that other hardware wallet providers also include minimal compensation clauses in their user agreements. Capping liability at the device’s purchase price or a small fixed amount is a common contractual design across the hardware wallet industry. The real issue worth discussing is the mismatch exposed when this is paired with a "free replacement" policy:

On one hand, there is a new device costing hundreds of dollars, with the company willingly assuming proactive responsibility for an additional 180 days. On the other, there is a contract that caps liability at $100 and states that "any assistance provided does not constitute an admission of liability." Both positions are commercially valid, but they create a sense of dissonance for users—A company can go above and beyond on moral grounds while contractually committing to only $100. Yet, when risks materialize for users, that $100 is often the only recourse available.

This reflects a structural mismatch inherent to the entire category. The ethical foundation of self-custody is that "users safeguard their own keys and therefore bear the consequences." This premise showed its first cracks during this incident:The compromised link—spanning from the factory to the warehouse, and from distributors to the customer’s doorstep—is precisely the part that users can neither control nor verify. Liability is placed entirely on users, while control over risk remains in the hands of manufacturers.

Hardware wallets have always been sold as "tools," not as "custodial services." When the tool itself becomes an attack vector, the argument that "the tool bears no responsibility" is facing its first true stress test.

Taking a broader view, this incident is the latest and most costly in a series of issues this year.

In 2026, six hardware wallet brands disclosed security issues, but only two incidents actually resulted in user financial losses: In July, weak entropy in Coldcard's firmware allowed mnemonic phrases to be guessed, with Galaxy Research estimating losses exceeding $115 million; and in this recent Ledger supply chain compromise, involving approximately $90 million. The total amounts to roughly $205 million. Industry analyst Wise Advice commented:"2026 could become the most chaotic year in the history of hardware wallet security."

Other issues were scattered across different points in the same supply chain: In June, Ledger's security team used lasers to penetrate the chip of the Trezor Safe 7, and in July, they breached Tangem cards (both attacks required laboratory equipment, with Tangem stating the risk to ordinary users was 'almost nonexistent'); BitBox patched several firmware vulnerabilities in August that its own engineers labeled 'critical,' though no losses occurred; Trezor's logistics provider leaked information on 13,689 buyers; and SafePal leaked nearly 40,000 home addresses.

Throughout the year, no secure element was genuinely compromised outside of a laboratory setting.Attackers bypassed cryptography, targeting adjacent vulnerabilities instead—random number generation, shipping manifests, distributor warehouses, and package deliveries at users' doorsteps.

The industry is seeking solutions, but consensus has yet to emerge. Yu Xian, founder of SlowMist, believes that 'tamper-evident self-destruction mechanisms will become essential... otherwise, there must be another mechanism to prove that the hardware wallet in hand is the product intended by the official manufacturer.' Mindao countered that once a device self-destructs, it becomes impossible to verify whether it was tampered with; detachable components at least allow for circuit diagram comparisons. Moreover, Ledger officially provides boot-time hardware integrity checks, though they are considered 'too technical' for average users. Others propose a simpler solution: multi-signature setups across brands, with Trezor, OneKey, and Keystone each holding one key, using Sparrow or Electrum for a 2/3 configuration to 'prevent misconduct by any single party.'

None of these suggestions involve 'buying a better chip.' They all point to the same conclusion: the security perimeter has expanded beyond the chip itself.

'Private keys never leave the device' has been the hardware wallet industry's promise for a decade. In this incident, while literally true, it proved meaningless.

The secure element was not modified, the operating system remained unchanged, and every transaction was confirmed by the user personally. The 24-word seed phrase never left the chip. It was meaningless because the keys did not need to leave the device—they only needed to be glanced at by someone else during the few seconds they were displayed on the screen. What was breached was not cryptography, nor even the chip, but the act of 'verification' itself: Genuine Check can verify the authenticity of the chip, but it cannot detect the eyes watching beside the screen.

Therefore, the lesson the industry needs to learn is not just tightening channel management, but enabling devices to attest to their own integrity, upgrading the acceptance standard from 'the chip is genuine' to 'the entire unit is original.' Tamper-evident self-destruction may be transitioning from an optional feature to a standard specification, which is more fundamental than simply shrinking the list of authorized distributors.

The question of liability remains unresolved. The industry’s standard contractual design involves delivering heavily integrated services while capping cumulative liability at the sale price of a single device or a small fixed amount. This is not necessarily an attempt to shirk responsibility; rather, it accurately reflects the liability structure inherent to this industry:It builds tools, not custodial assets. The real issue is that users have long believed they were purchasing something other than just a tool.

24K Views