Your hardware wallet could also arrive tampered with: security starts before you turn it on.

Ledger confirmed an unauthorized implant in a device belonging to a user affected by the investigation related to CryptoBilis. The October 10 update adds a physical component to the case.

My take: when discussing self-custody, we tend to focus on passwords and recovery phrases, but we should also consider how the device reaches us. For users in Mexico and Latin America, it’s worth watching which units the investigation identifies, what guidance the manufacturer publishes, and whether any impacts emerge outside the market in question. A specialized device can reduce certain risks, but its brand name is no substitute for careful purchasing or secure setup.