In 2023, Kaspersky disclosed a case that I think everyone buying a hardware wallet should know about: the device wasn't connected to a computer, yet the coins were still transferred—the problem arose before the buyer ever got it.
The victim bought a Trezor Model T on a secondhand classifieds website. The anti-counterfeit holographic stickers on the box and device were intact. Only when Kaspersky took it apart did they discover that the casing had been glued and taped together, the main control chip had been replaced, and the bootloader version had never been released by the manufacturer.
The modified firmware did three things: removed signature verification so the device wouldn't trigger an alarm at startup; replaced the randomly generated recovery phrase during initialization or reset with one of 20 phrases preloaded in the firmware; and, if an additional password was set, used only its first character. So even a reset couldn't escape those 20 phrases, and the attacker knew the private key from the start. Transaction records show they waited a month before making their move.
Trezor confirmed that this was a third-party modification and said the supply chain attack happened more than a year before the article was published. This was not a remote hack of an authentic Trezor, nor was it a new vulnerability.
I wouldn’t judge security based only on an anti-counterfeit sticker. An intact sticker doesn’t mean the chip and firmware inside haven’t been tampered with. Trezor’s official documentation says its devices leave the factory without firmware and have no default recovery phrase. If a new device already has firmware installed, contact official support immediately. These are Trezor’s own factory procedures; other brands may have different ones, so check each manufacturer’s official documentation.
The main advice from Kaspersky and Trezor is to buy through official channels and not ignore warnings on the device. I wouldn’t use a secondhand hardware wallet from an unknown source to store money.