A hole poked by a wallet dealer: a liability cap of $100 cannot cover a loss of $90 million

Author: Gu Yu, ChainCatcher

On the afternoon of October 13, Ledger issued its longest official update since the incident, detailing the attack method down to the component level: the implanted module hidden inside the device's casing, "reads the data displayed on the screen"------during initialization, the device displays a 24-word mnemonic on the screen, which the module recognizes and decodes via the microcontroller, then sends out through a pre-configured eSIM via LTE.

More crucially, a clarification followed closely: the implanted module is an independent component, does not modify the secure element, does not modify the operating system, and does not change transactions or signatures. The chip is genuine, the system is original, and each transaction is confirmed by the user themselves------the checks taught to users by the industry, all these devices passed. The mnemonic only appeared on the screen for those few seconds, but it had an extra pair of eyes.

However, this update only answered "what happened inside the device," and did not address "what about those who lost money." Among the 164 replies, the most liked follow-up questions were almost all asking the same thing: if a device purchased from an official authorized dealer was tampered with and resulted in financial loss, would Ledger take responsibility and compensate? What about users from the MediaMarkt channel in the EU? Ledger's stance is: all confirmed financial losses involve devices sold by CryptoBilis, while other channels "have not been verified."

Four days ago, this was merely "a problem with a dealer from a certain company"; now, it has become a question that the entire hardware wallet industry must answer together: who is responsible for the integrity of the device from the moment it leaves the factory?

I. From a Dealer to a Chain

On October 9, users in Southeast Asia reported that assets were being transferred; on October 10, Ledger confirmed that one affected user's device contained unauthorized hardware implants, marking the first time physical evidence was obtained; on the same day, CryptoBilis announced a suspension of sales and shipments of Ledger devices. An authorized dealer, a batch of affected users, a cut------the narrative up to this point is almost complete.

But in the following days, each new clue expanded this framework.

The first anomaly lies in the devices themselves. Most confirmed modified devices are brand new, not returned units. The industry's default risk model has always been "user buys a new device---device is modified---returned---next customer gets hit," and this path's premise is that modification occurs after sale; the fact that brand new devices have been tampered with means the modification happened before the device reached any user------the problem shifted from "a link in the channel" to "a step in the warehouse."

The second anomaly is the craftsmanship. Karpelès compared early samples with the latest ones in a blog post: the former showed obvious signs of handcrafting, while the latter appeared to be produced on demand. If this observation holds, the tampering was not a spur-of-the-moment decision by an individual, but a chain capable of mass-producing implanted modules. The numbers on the chain are also being revised upwards: Specter initially estimated over $86 million, while Bitquery's analysis on October 12 across 324 wallets and multiple chains estimated about $102 million------yet Ledger has only stated: "We have not confirmed the total number of affected users or the total value of losses."

Then the clues began to cross borders. On the European side, user Johannes reported purchasing two modified devices from two different MediaMarkt stores, and he asked store employees to check inventory records, with at least one device coming from Aqipa GmbH------a distributor covering all of Europe, potentially affecting areas far beyond Germany. On the Asian side, Karpelès's device was purchased from Amazon Japan, shipped by a Chinese seller, and sent from Malaysia; the Japanese seller channel Nano X reported by research institution Tibane Labs also shipped from Malaysia. Two clues thousands of miles apart point to the same shipping location.

The other end of the chain is equally professional. Tether froze $10 million USDT on the first day, and the attacker immediately exchanged $15 million USDT for USDD, which Tether cannot freeze, then exchanged back for about $5.1 million USDT, with about $4.23 million flowing into a Binance deposit address; 2,810 ETH entered Tornado Cash in three rounds. As of October 11, there were still 15,475 ETH, 203 BTC, and $10 million USDT in the hands of the attacker. CZ proposed a more radical speculation------that the attacker bought this dealer and had them sign a non-disclosure agreement to remain silent; this claim has not been verified, but the professionalism of the chain is evident.

Putting these clues together, it is hard to explain it as "accidental": a bought dealer is an incident, a cross-border chain capable of mass modification and evading freezes is a vulnerability. The former can be dealt with by cutting the list, the latter cannot. Ledger claims it is developing more robust hardware anti-tampering measures but has not specified the details or timeline; the self-check solution it provided is for users to compare component photos and check the device themselves, while the official tutorial simultaneously warns that opening the device may cause damage. A verification process that requires users to disassemble the device to complete itself indicates that the industry still does not have an answer.

II. What Are Peers Doing

Beyond the incident, the differences in responses from various manufacturers are more informative. In fact, CryptoBilis not only sells Ledger but also sells many hardware wallets including Trezor, CoolWallet, Tangem, OneKey, SecuX, and Ellipal.

On the afternoon of the day the incident broke, Keystone's Chinese account posted a recommendation for the Keystone 3 Pro's PCI-level self-destruct feature: once physical disassembly or tampering is detected, it automatically erases chip data, rendering the device useless. This tweet garnered 42,000 views. It precisely hit the crux of this attack------the implanted module must be installed by opening the casing, and self-destruction turns "quiet installation" into "installed and gone." But precisely because it was chosen at this time, it brought an awkward matter to the forefront: the industry has actually always had a technical answer, but no one felt it was necessary before.

Most manufacturers' first reaction was to distance themselves. Trezor removed CryptoBilis from its authorized list and stopped sales through that channel, while reminding users not to disassemble the devices themselves; imKey stated it had not received relevant feedback and would verify authorized channels.

SafePal emphasized that its devices verify authenticity and usage status during initial setup, issue warnings for previously activated devices, and display the first activation date, using tamper-evident seals to identify whether the packaging has been opened. Tangem went further, making tampering impossible from the architecture level: the secure chip and NFC antenna are integrated and sealed, private keys are generated and signed within the chip, and firmware written by the factory cannot be modified------"Regardless of whether users purchase through official stores, dealers, or other channels, as long as the App verifies the device as genuine, it ensures that the private key is solely controlled by the user."

But Tangem's statement precisely bypassed the key issue: verification, can it self-verify? The fact is, Ledger's Genuine Check can only verify that the secure chip is genuine and cannot detect what physical alterations have been made to the components surrounding the chip------devices with implanted modules can pass authenticity checks. No matter how tightly the channel is managed, it only reduces the probability, not eliminates the risk.

In response to market skepticism, OneKey announced unconditional free replacements for users who purchased through that channel since March of this year, with no need to return old devices, while re-evaluating all existing dealers, stating that "if the operating entity cannot be verified and the ultimate beneficiary cannot be clarified, authorization will be revoked," and admitting that "the dealer network will be significantly reduced."

III. $100: The Liability Cap That Was Unearthed

After the news of OneKey's free replacements spread, the community began to scrutinize its user agreement, which ironically led to a major public crisis for OneKey itself.

The current "Service Agreement" Article 15.5 states: if OneKey is found liable to users, its cumulative liability cap shall not exceed the highest of the following three:------(a) the actual purchase price of the device; (b) the fees actually paid by the user for the paid service within the 12 months prior to the incident; (c) one hundred dollars (USD 100). Moreover, this is a "single cumulative cap, and multiple claims, multiple incidents, or multiple legal bases will not increase its amount."

Article 15.4 is even more thorough: to the maximum extent permitted by applicable law, OneKey shall not be liable for any loss or impairment of digital assets, regardless of the cause------the device and App are merely tools for managing keys and do not provide insurance or guarantees for assets. Article 15.6 provides a rationale: the App and most services are free, the device price does not include asset insurance, OneKey never holds users' assets or credentials, nor does it know how much users have stored. Article 15.10 leaves a way out: OneKey may decide to provide compensation, replacement, or other assistance at its discretion, but any such action is merely a gesture of goodwill, does not constitute an acknowledgment of liability, does not set a precedent, and does not create any obligations to anyone, and may require users to sign a disclaimer as a condition.

It should be clarified that this is not just OneKey's approach. OneKey's officials have listed other hardware wallets that also include very low compensation modules in their user agreements. Capping liability at the device price or a small fixed number is a common clause design in the hardware wallet industry. What is truly worth discussing is the mismatch exposed when it is placed alongside "free replacements":

On one side is a new device costing hundreds of dollars, willing to take on active responsibility for 180 days; on the other side is a contract that caps liability at $100 and states "any assistance does not constitute an acknowledgment of liability." Both are commercially valid, but users' feelings about them are torn------a company can morally achieve 120 points while contractually only committing to $100. And this $100 is precisely the only thing that can be brought out when the risk truly falls on the user.

It reflects a structural mismatch in the entire category. The entire ethical foundation of self-custody is "users manage their own keys, therefore users bear the consequences." This premise has shown cracks for the first time in this incident: the breached link------from factory to warehouse, from dealer to doorstep------is precisely the part that users cannot control or verify in any way. Responsibility has been entirely placed on the user, while the control over risk lies with the manufacturers.

Hardware wallets have always sold "tools," not "custody." When the tool itself becomes an attack surface, the narrative of "the tool is not responsible" is facing its first real stress test.

IV. 2026: The "Physical Year" of Hardware Wallets

Widening the perspective, this incident is the latest and most costly in a series of issues this year.

In 2026, six hardware wallet brands have disclosed security issues, but only two incidents have actually led to user losses: in July, Coldcard's firmware weak entropy allowed mnemonic phrases to be guessed, resulting in losses exceeding $115 million according to Galaxy Research; and this time, Ledger's supply chain compromise, amounting to about $90 million. The total is approximately $205 million. The evaluation from the industry analysis firm Wise Advice is: "2026 may become the craziest year in the history of hardware wallet security."

The remaining issues are distributed across different locations on the same chain: in June, Ledger's security team used lasers to breach the chip of Trezor Safe 7, and in July, they breached Tangem cards (both required laboratory equipment, and Tangem claimed that the risk to ordinary users was "almost nonexistent"); BitBox fixed several firmware vulnerabilities deemed "serious" by its engineers in August, which did not result in losses; Trezor's logistics provider leaked information of 13,689 buyers; SafePal leaked nearly 40,000 home addresses.

This year, no security chip has been truly breached outside the laboratory. Attackers bypassed cryptography and turned to adjacent elements—random numbers, logistics orders, dealer warehouses, and deliveries at users' doorsteps.

The industry is seeking answers, but there is no consensus yet. Yu Xian, founder of Slow Mist, believes that "a self-destruct feature will be a necessary mechanism… otherwise, there needs to be another mechanism to prove that the hardware wallet I have is the product of the official original intent"; Mindao counters that once self-destruction occurs, it cannot prove whether the machine has been tampered with, while being removable at least allows for circuit diagram comparisons, and Ledger actually provides a hardware integrity check at startup, which is just "too hardcore" for ordinary users; others propose the simplest solution—cross-brand multi-signature, with Trezor, OneKey, and Keystone each holding one key, using Sparrow or Electrum for 2/3, "to prevent one party from doing evil."

None of these suggestions include "buy a better chip." They all point to the same thing: the security boundary has expanded beyond the chip.

Conclusion

"The private key has never left the device" is a promise the hardware wallet industry has sold for ten years. In this incident, it holds true literally, yet is meaningless.

The security component was not modified, the operating system was not altered, every transaction was confirmed by the user themselves, and the 24 words never left that chip. It is meaningless because the key does not need to leave the device—only needs to be glanced at for a few seconds on the screen. What was breached is not the cryptography, nor even the chip, but the action of "verification" itself: Genuine Check can verify the authenticity of the chip, but cannot verify the eyes beside the screen.

Thus, the lesson the industry needs to learn is not to tighten the channels further, but to let the device testify itself, upgrading the acceptance standard from "the chip is real" to "the whole device is original"—self-destructing upon disassembly may be transitioning from an option to a standard feature, which is more fundamental than any contraction of a dealer list.

The question of responsibility remains unresolved. The common contractual design in this industry is to make the service as heavy as possible while capping cumulative liability to the price of a device or a small fixed number. It is not necessarily shirking responsibility, but rather a truthful description of the industry's liability structure: it creates tools, not manages assets. The real issue is that users have always believed they were buying more than just tools.