How to Buy a Cold Wallet Safely: Lessons From the Ledger Implant Case (Nov 2026)

What happened in the Ledger implant case?

In October 2026, a batch of Ledger cold wallets sold through CryptoBilis, a reseller in Southeast Asia, was found to contain an extra chip. The moment a user set up the wallet for the first time and the screen showed the 24-word seed phrase, the chip read the words off the display and sent them out over a mobile network.

Whoever holds the seed phrase holds the whole wallet. On-chain researchers estimate the losses anywhere from about $86 million to over $100 million, and Ledger has not confirmed a total.

Singapore police later issued an advisory too: some people bought tampered Ledger devices at retail stores in Singapore.

How can a chip be hidden inside a cold wallet?

The attack works only when three conditions come together.

First, someone opened the device before you did. Ledger says the attackers bought genuine devices, opened them, installed a hidden component, and put them back into the reseller channel for sale.

Second, the seed phrase appears on the screen. During setup, the secure chip sends the 24 words to the screen. Researchers who opened a tampered Nano X found that the added chip was wired into this display line and read the 24 words straight from the signal, with no need for a camera to capture the screen.

Third, there is room inside, and there is power. Researchers found that some versions swapped the original battery for a smaller one, and others removed the foam under the screen to make space. The added chip ran on the wallet’s own battery and carried its own mobile modem and eSIM, so it could send the seed phrase out without going through your phone or computer.

Researcher Joe Grand opened and inspected a Nano X fitted with a similar chip (not from the CryptoBilis batch) and walked through the whole inspection in his hardwear.io USA 2026 talk.

The problem isn’t the screen. It’s where you buy and how the device is built.

The screen is where the seed phrase gets read, but a screen is also what lets you check the address and amount of a transaction on the device. The whole thing started because the device was opened before it reached the buyer.

Ledger says its own chips, operating system and servers have no vulnerability in this case, and that the problem lies in the reseller channel after devices leave the factory. Ledger asked authorized resellers in Southeast Asia and Hong Kong to pause sales at the time, and restated that returned devices must never be resold.

Here is the tricky part: the original secure chip was intact, so Ledger’s official authenticity check could not catch the added one. This isn’t only a Ledger issue. For a hardware wallet of any brand, the purchase channel is part of the security.

So the biggest risk is where you buy, and the device design comes second: whether the seed phrase is ever displayed, and whether the device has the room and battery for an added chip to run.

Wallets with a screen or without: which should you choose?

Start by checking whether the device has its own screen. Some card-shaped cold wallets come with a screen too. Measured against the three conditions above, the difference becomes clear.

Wallets with a screen, such as the screen models from Ledger, OneKey and SafePal, plus CoolWallet Pro and S. When you send funds you can check the address and amount on the device, and most use a seed phrase backup.

Card wallets without a screen, such as Tangem. According to Tangem’s published specs, it is powered by NFC from your phone, so it has no battery, and you check the transaction details in the phone app. The chip carries EAL6+ security certification, and the no-seed-phrase mode backs up the same wallet on paired cards: once all three are paired, you can lose one and keep using the others. From the second generation on, you can also choose a seed phrase during first setup.

Tangem says that in the no-seed-phrase mode, the private key is generated inside the card chip and no seed phrase is ever shown, so there is no line carrying those 24 words that someone could tap. According to Tangem’s published specs, the card has no battery and is powered through NFC only when held close to a phone, and the chip and antenna are sealed in one thin card, leaving no room to add another chip, a battery and a mobile modem. With the method used in this case, an attacker finds nothing to work with on the card, so a card-type wallet lowers the risk of this kind of implant.

The card’s risks lie elsewhere. The phone displays the transaction, so your phone’s security matters more. The card itself also needs safekeeping, and the biggest risk is it landing in someone else’s hands.

A wallet with a screen lets you check transactions on the device, while a card without a screen relies on your phone’s display. No cold wallet stops every attack. Buy either kind from official channels and back it up properly.

What is a cold wallet?

A cold wallet, also called a hardware wallet, is a small device dedicated to keeping your private keys. When you send funds, the device signs the transaction, so the private key is never exposed to an online environment.

Coins on an exchange are held by the exchange for you. A hot wallet on your phone or computer keeps the private key on a machine that is online every day. A cold wallet puts the private key in your own hands and keeps it off the network, which is why many people use one for long-term holdings.

The trade-off is that backups are your own responsibility.

What to check before buying a cold wallet

• Buy only from the official store or an authorized reseller. Skip online marketplaces, secondhand sellers and proxy purchases.
• Don’t buy anything unusually cheap. A price far below the official one usually has a reason.
• If a seed phrase is already written down, return it. A new wallet should be set up by you through the official process. Never use a seed phrase that comes with it.
• Inspect the packaging. If the seal, the film or the box looks opened, don’t turn it on.
• Run the official authenticity check once. It won’t stop every kind of attack, but it catches many counterfeits.
• Never type your seed phrase into a phone or any website. If a support message or verification page asks for it, stop right away.

How do you set up a cold wallet after it arrives?

1. Look over the packaging again before opening it, and take photos for your records.
2. Check the latest official security notices first. If your device or the channel you bought from is covered by a warning, don’t set it up yet and follow the official instructions. If all is clear, run the authenticity check in the official app.
3. Create a new wallet and set a PIN or access code. For models that use a seed phrase backup, have the hardware device generate a fresh seed phrase, and never import one that someone else gave you. If you use Tangem’s no-seed-phrase mode, pair all the backup cards during first setup.
4. Only models with a seed phrase backup need you to write words down. Write them on paper by hand, with no photos, no screenshots and no cloud storage, and make sure no one else can see the words and no camera can capture them as you write.
5. Send in a small amount first, then try sending it back out. Confirm you can both receive and send before moving a large amount.
6. Store the paper seed phrase or backup cards in separate places, and make sure a trusted family member knows where to look in an emergency.

Penchan’s pick

I have about five different cold wallets, and the one I chose is Tangem.

Before Black Friday 2025, I said on X that I wanted a cold wallet that needs no battery, and I was torn between the OneKey 1S Pure and Tangem. I paid for two Tangem sets myself.

Whichever one you end up with, Ledger’s reminder to everyone from this case is the same: first make sure you know who is selling it to you, then compare specs.