Twice in two days, the hardware wallet world has given me the creeps
The first was Ledger
Devices sold by Southeast Asian distributor CryptoBilis were implanted with LTE eSIM modules, which transmitted recovery phrases in real time the moment they were initialized
The official 72-hour update on October 12 clarified the scope
- The number of affected devices is limited
- All confirmed cases involve CryptoBilis
- Ledger's own systems and direct sales channels were unaffected
- CryptoBilis has halted all sales
CZ also posted a warning, essentially confirming this was a supply-chain attack by a single distributor
The second was OneKey
User @blocktom dug up clause IX.8 of an older English-language agreement
The company’s compensation cap for user losses is the higher of “the market value of 0.1 ETH” or “100 Singapore dollars”
The Chinese version simply removed this clause
OneKey acknowledges its documentation was outdated, apologizes, and updates its terms
The new cap is the highest of “the actual price paid for the device,” “fees paid for services in the past 12 months,” and “$100”
But at the same time, clause 15.4 says
To the extent permitted by law, they generally accept no liability for the loss of digital assets or their value, regardless of the cause
The user kept pressing for an answer
What if an investigation determines the loss was caused by a defect in your own hardware, firmware, or app?
The founder, @ohyishi, blocked the user
One supply chain was compromised; one set of terms was laid bare
Together, these two incidents point to the same black hole
The boundaries of responsibility for hardware wallets are far less clear than most people think
/
❚ The real boundaries of responsibility in self-custody
Let’s lay out the facts
The compensation caps in the user agreements of major wallets are roughly as follows
- Coinbase Wallet / Trust Wallet / Phantom / Uniswap Wallet: $100 cap
- Ledger / Trezor: generally capped at the device’s retail price
- SafePal / Tangem: compensation is generally off the table
- OneKey’s new terms: the highest of the device price, fees paid over 12 months, or $100
Put simply,
Whether you’ve got $10 or $10 million on it
If the manufacturer pays you enough to replace the hardware when something goes wrong, that’s already generous
In most cases, they won’t even reimburse you for the hardware
The manufacturers’ logic isn’t hard to understand
Self-custody means the manufacturer doesn’t hold your private keys. It can neither freeze your assets nor reverse on-chain transactions
So they can’t offer genuine insurance; low compensation caps are standard in the industry
This logic is mathematically consistent
But that’s completely different from what most retail buyers expect when they buy a cold wallet
❚ What retail buyers have in mind when they buy a cold wallet
In August 2024, Lazarus stole all my on-chain assets. It was like losing a Mercedes E300L
Since then, I’ve learned firsthand what cold wallets are really like
This was the logic in my head at the time
- Hot wallets aren’t safe, so I spend money on a cold wallet
- It’s a branded cold wallet, so it should be fine
- If something really goes wrong, at least you have some expectation of compensation
- Otherwise, why would I spend money on a brick?
But then I opened the terms
- First: if something goes wrong, we don’t guarantee compensation
- Second: even if you’re compensated, the cap is just the cost of one hardware wallet
- Third: leaks of your recovery phrase, phishing, third-party services, and issues with the blockchain itself are all excluded
- Fourth: we have the final say on how this is interpreted
Put simply, all you’re buying is “a signing device that’s harder to attack remotely than a hot wallet”
You’re responsible for every other risk
❚ Looking at the two incidents together
This time, Ledger was hit by a physical supply-chain attack
The implant was hidden where the screen cushioning sits. The firmware couldn’t detect it, and neither could Genuine Check. You’d only find it by taking the device apart
This means
- “I bought a genuine Ledger” isn’t enough
- “I bought it from a Ledger authorized reseller” isn’t enough either
- The only safe starting point is “I bought directly from the Ledger website”
This time, OneKey’s terms got put under the microscope
The inconsistency between the Chinese and English versions is just a minor issue by itself
But the boundaries of responsibility this raises are what really stand out
- If a product defect causes a loss, the compensation cap under the terms is $100 or the device price
- The manufacturer won’t give users a straight answer when they press for one
- Follow up too much and you get blocked
Together, these two incidents laid bare the entire industry
The real promise of a hardware wallet is that it’s a “signing tool”
The idea of an asset safe is just wishful thinking
/
❚ What should retail users do?
Now that we’ve covered the principles, here’s what you can actually do
1/ Don’t expect the manufacturer to bail you out
- Any self-custody wallet, any brand, even one that’s “the world’s best-selling”
- This is the baseline in all their terms
- Be mentally prepared to receive no compensation
2/ Buy cold wallets directly from the official website
- Don’t buy from resellers
- Don’t buy from Xianyu
- Don’t have a friend buy it for you
- Be wary of any channel offering a price “lower than the official website”
3/ Split large holdings across separate wallets
- Don’t keep more than half your net worth in one cold wallet
- Spread the rest across multisig, multiple addresses, and multiple brands
- For multisig, use at least two different brands so a problem at one manufacturer doesn’t bring everything down
4/ Rotate addresses regularly
- Switch to a new one every so often
- Keep the old address as a cold backup
- It’s like changing the lock on your account
5/ Keep some assets on centralized exchanges
- It sounds counterintuitive, but it’s true
- In extreme cases, the SAFU fund and insurance at major exchanges may actually provide some cover
- This doesn’t mean keeping your life savings on a CEX; just don’t let a cold wallet be your only line of defense
/
In a nutshell: taken together, these two incidents completely shatter the illusion that “buying a hardware wallet makes you safe”
A hardware wallet is just one part of your security strategy
Real security comes from diversification, redundancy, and regular maintenance
It’s just like working out: no single move can keep you from ever getting injured; only the habit of training consistently can
Lessons from when I lost my “Mercedes” in 2024
There’s a line I wrote that’s stuck with me ever since
“In the crypto world, you’re not up against the market. You’re up against all the malice in humanity.”
It’s still the same today