A hole poked by a wallet dealer: a liability cap of 100 USD cannot cover a loss of 90 million

Author: Gu Yu, ChainCatcher

On the afternoon of October 13, Ledger issued its longest official update since the incident, detailing the attack method down to the component level: the implanted module is hidden inside the device casing, "reading the data displayed on the screen"------during initialization, the device displays a 24-word mnemonic phrase on the screen, which the module recognizes and decodes via a microcontroller, then sends out through a pre-configured eSIM via LTE.

More critically, a clarification followed: the implanted module is an independent component, does not modify the secure element, does not modify the operating system, and does not change transactions or signatures. The chip is genuine, the system is original, and each transaction is confirmed by the user themselves------the checks taught to users by the industry, all of this batch of devices passed. The mnemonic phrase only appeared on the screen for those few seconds, but it had an extra pair of eyes.

However, this update only answered "what happened inside the device," and did not address "what about those who lost money." Among 164 replies, the most liked follow-up questions were almost all asking the same thing: if devices purchased from authorized dealers were tampered with and resulted in financial losses, would Ledger take responsibility and compensate? What about users from the MediaMarkt channel in the EU? Ledger's stance is: all confirmed financial losses involve devices sold by CryptoBilis, while other channels are "not yet verified."

Four days ago, it was merely "a problem with a dealer of a certain company"; now, it has become a question that the entire hardware wallet industry must answer together: who is responsible for the integrity of the device from the moment it leaves the factory?

I. From a Dealer to a Chain

On October 9, users in Southeast Asia reported that assets were transferred away; on October 10, Ledger confirmed that one affected user's device contained unauthorized hardware implants, marking the first physical evidence obtained; on the same day, CryptoBilis announced a suspension of sales and shipments of Ledger devices. An authorized dealer, a batch of affected users, a cut------the narrative up to this point is almost complete.

But in the following days, each new clue expanded this framework.

The first anomaly lies in the devices themselves. Most of the confirmed modified devices are brand new, not returned units. The industry's default risk model has always been "user buys a new device---device is modified---returned---next customer gets hit," which assumes that modification occurs after the sale; the fact that brand new devices have been tampered with means that modification happened before the device reached any user------the problem shifted from "a link in the channel" to "a step in the warehouse."

The second anomaly is the craftsmanship. Karpelès compared early samples with the latest ones in his blog: the former showed obvious signs of manual production, while the latter appeared to be produced on demand. If this observation holds, the tampering was not a spur-of-the-moment decision by an individual, but a chain capable of mass-producing implanted modules. The figures on the chain are also being revised upwards: Specter initially estimated over $86 million, while Bitquery's analysis on October 12 across 324 wallets and multiple chains estimated about $102 million------yet Ledger has only stated: "We have not yet confirmed the total number of affected users or the total value of losses."

Then the clues began to cross borders. On the European side, user Johannes reported buying two modified devices from two different MediaMarkt stores, and he asked store employees to check the inventory records, with at least one device coming from Aqipa GmbH------a distributor covering all of Europe, potentially affecting areas far beyond Germany. On the Asian side, Karpelès's device was purchased from Amazon Japan, shipped by a Chinese seller, and sent from Malaysia; the Japanese seller channel Nano X reported by research institution Tibane Labs also shipped from Malaysia. Two clues thousands of miles apart point to the same shipping location.

The other end of the chain is equally professional. Tether froze $10 million USDT on the first day, and the attacker immediately converted $15 million USDT into USDD, which Tether cannot freeze, then converted back to about $5.1 million USDT, of which about $4.23 million flowed into a Binance deposit address; 2,810 ETH entered Tornado Cash in three rounds. As of October 11, there were still 15,475 ETH, 203 BTC, and $10 million USDT in the hands of the attacker. CZ proposed a more radical speculation------the attacker bought this dealer and had them sign a confidentiality agreement to remain silent; this claim has not yet been verified, but the professionalism of the chain is evident.

Putting these clues together, it is hard to explain it as "incidental": a dealer that was bought off is an accident, a cross-border chain capable of mass modification and evading freezes is a vulnerability. The former can be dealt with by cutting off the list, the latter cannot. Ledger claims it is developing more robust hardware anti-tampering measures but has not specified the details or implementation timeline; the self-check solution it provided is for users to compare component photos and check the device themselves, while the official tutorial simultaneously warns that opening the device may cause damage. A verification process that requires users to disassemble the device to complete itself indicates that the industry still does not have an answer.

II. What Are Peers Doing

Outside the incident, the differences in responses from various manufacturers are even more informative. In fact, CryptoBilis not only sells Ledger but also sells numerous hardware wallets such as Trezor, CoolWallet, Tangem, OneKey, SecuX, and Ellipal.

On the afternoon of the day the incident broke, Keystone's Chinese account posted about the PCI-level self-destruct feature of the Keystone 3 Pro: once physical disassembly or tampering is detected, it automatically erases chip data, rendering the device useless. This tweet received 42,000 views. It precisely hit the Achilles' heel of this attack------the implanted module must be installed by opening the casing, and self-destruction turns "quiet installation" into "once installed, it's gone." But precisely because it was chosen at this time, it brought an awkward matter to the forefront: the industry has actually had technical answers all along, but no one felt it was necessary to implement them before.

Most manufacturers' first response was to distance themselves. Trezor removed CryptoBilis from its authorized list and stopped sales through that channel, while reminding users not to disassemble the device themselves; imKey stated it had not received relevant feedback and would verify authorized channels.

SafePal emphasized that its devices verify authenticity and usage status during initial setup, issue warnings for previously activated devices, and display the first activation date, using tamper-evident seals to identify whether the packaging has been opened. Tangem went further, making tampering impossible from the architecture level: the secure chip and NFC antenna are integrated and sealed, private keys are generated and signed within the chip, and the firmware written by the factory cannot be modified------"Regardless of whether users purchase through official stores, dealers, or other channels, as long as the app verifies the device as genuine, it ensures that the private key is solely controlled by the user."

But Tangem's statement precisely bypasses the crux: verification, can it self-verify? The fact is, Ledger's Genuine Check can only verify that the secure chip is genuine and cannot detect any physical alterations made to the components surrounding the chip------devices with implanted modules can pass authenticity checks. No matter how tightly the channel is managed, it only reduces the probability, not eliminates the risk.

In the face of market skepticism, OneKey announced unconditional free replacements for users who purchased through that channel since March of this year, with no need to return old devices, while re-evaluating all existing dealers, stating that "if the operating entity cannot be verified, or the ultimate beneficiary cannot be clarified, authorization will be revoked," and admitting that "the dealer network will be significantly reduced."

III. $100: The Revealed Liability Cap

After the news of OneKey's free replacements spread, the community began to review its user agreement, which ironically led to a large public crisis for OneKey itself.

The current "Service Agreement" Article 15.5 states: if OneKey is determined to be liable to users, its cumulative liability cap shall not exceed the highest of the following three: (a) the actual purchase price of the device; (b) the fees actually paid by the user for the paid service within the 12 months prior to the incident; (c) one hundred dollars (USD 100). Moreover, this is a "single cumulative cap, multiple claims, multiple incidents, or multiple legal bases will not increase its amount."

Article 15.4 is even more thorough: to the maximum extent permitted by applicable law, OneKey shall not be liable for any loss or impairment of digital assets, regardless of the cause------the device and app are merely tools for managing keys and do not provide insurance or guarantees for assets. Article 15.6 provides a rationale: the app and most services are free, the device price does not include asset insurance, OneKey never holds users' assets or credentials, nor does it know how much users have stored. Article 15.10 reserves an escape route: OneKey may decide to provide compensation, replacement, or other assistance at its discretion, but any such measures are merely goodwill expressions, do not constitute an acknowledgment of liability, do not set a precedent, and do not create obligations to anyone, and may require users to sign a disclaimer as a condition.

It should be clarified that this is not just OneKey's approach. OneKey's official has listed other hardware wallets that also include very low compensation modules in their user agreements. Capping liability at the device price or a small fixed number is a common clause design in the hardware wallet industry. What is truly worth discussing is the mismatch exposed when it is placed alongside "free replacements":

On one side is a new device costing hundreds of dollars, willing to cover active responsibility for an additional 180 days; on the other side is a contract that caps liability at $100 and states "any assistance does not constitute an acknowledgment of liability." Both are commercially valid, but users' feelings towards them are torn------a company can morally achieve 120 points while contractually only committing to $100. And this $100 is precisely the only thing that can be brought out when the risk truly falls on the user.

It reflects a structural mismatch across the entire category. The entire ethical foundation of self-custody is "users manage their own keys, therefore users bear the consequences." This premise has cracked for the first time in this incident: the breached link------from factory to warehouse, from dealer to doorstep------is precisely the part that users cannot control or verify in any way. Responsibility has been completely placed on the user, while the control over risk remains in the hands of the manufacturers.

Hardware wallets have always sold "tools," not "custody." When the tool itself becomes an attack surface, the narrative of "tools are not responsible" is facing its first real stress test.

IV. 2026: The "Physical Year" of Hardware Wallets

Widening the perspective, this incident is the latest and most expensive in a series of issues this year.

In 2026, six hardware wallet brands have disclosed security issues, but only two incidents have actually led to user losses: in July, Coldcard's firmware weak entropy allowed recovery phrases to be guessed, resulting in losses exceeding $115 million according to Galaxy Research; and this time, the supply chain breach at Ledger caused about $90 million in losses. The total amounts to approximately $205 million. The evaluation from the industry analysis agency Wise Advice is: "2026 may become the craziest year in the history of hardware wallet security."

The remaining issues are distributed at different locations on the same chain: in June, Ledger's security team used lasers to penetrate the chip of Trezor Safe 7, and in July, they penetrated Tangem cards (both required laboratory equipment, with Tangem claiming that the risk to ordinary users is "almost nonexistent"); BitBox fixed several firmware vulnerabilities deemed "serious" by their engineers in August, which did not cause any losses; Trezor's logistics provider leaked information of 13,689 buyers; SafePal leaked nearly 40,000 home addresses.

This year, no security chip has been truly breached outside the laboratory. Attackers bypassed cryptography and turned to adjacent elements—random numbers, logistics slips, dealer warehouses, and deliveries at users' doorsteps.

The industry is seeking answers, but there is no consensus yet. Yu Xian, founder of Slow Mist, believes that "self-destruct mechanisms will be a necessary feature… otherwise, there needs to be another mechanism to prove that the hardware wallet I have is the product of the official original intent"; Mindao counters that once self-destruction occurs, it cannot prove whether the machine has been tampered with, while removable parts can at least compare circuit diagrams, and Ledger actually provides a hardware integrity check at startup, which is just "too hardcore" for ordinary users; others propose the simplest solution—cross-brand multi-signature, with Trezor, OneKey, and Keystone each holding one key, using Sparrow or Electrum for 2/3, "to prevent one party from doing evil."

None of these suggestions include "buy a better chip." They all point to the same thing: the security boundary has expanded from the chip to beyond the chip.

Conclusion

"The private key has never left the device" is a promise that the hardware wallet industry has sold for ten years. In this incident, it holds true literally, yet is meaningless.

The security component was not modified, the operating system was not altered, each transaction was confirmed by the user, and the 24 words never left that chip. It is meaningless because the key does not need to leave the device—it only needs to be looked at for a few seconds on the screen. What was breached is not the cryptography, nor even the chip, but the action of "verification" itself: Genuine Check can verify the authenticity of the chip but cannot verify the eyes next to the screen.

Therefore, the lesson the industry needs to learn is not to tighten channel management but to let the device testify itself, upgrading the acceptance standard from "the chip is real" to "the whole unit is original"—self-destruct mechanisms may be transitioning from optional to standard, which is more fundamental than any contraction of dealer lists.

The question of responsibility remains unresolved. The common contractual design in this industry is to make services as heavy as possible while capping cumulative liability at the price of a single device or a small fixed number. It may not be about shirking responsibility but rather accurately describing the responsibility structure of this industry: it creates tools, not manages assets. The real issue is that users have always believed they were buying more than just tools.