Crypto analyst Steph Is Crypto has called on XRP holders to closely inspect their hardware wallets after reports surfaced of a major theft involving Ledger devices. The advisory highlights a critical security issue: a hardware wallet should never arrive with a recovery phrase already written down or included in the packaging.
Hardware wallet security under scrutiny
Steph Is Crypto drew attention to the risk by referencing a warning from a former Goldman Sachs analyst, who cautioned that any wallet arriving with a pre-filled recovery or seed phrase presents a serious security vulnerability. A legitimate hardware wallet should generate the recovery phrase during the device’s initial setup, ensuring that only the user knows these crucial words.
Users should never accept a hardware wallet where the recovery phrase is provided in advance, as this greatly increases the risk of theft.
The warnings follow reports of losses linked to recent Ledger-related incidents that are estimated to total between $86 million and $90 million. Initial claims suggested the figure surpassed $90 billion, but upon review, available evidence supports a loss in the $86 million to $90 million range.
Risks with pre-filled recovery phrases
A recovery phrase serves as the access key for users to control their crypto accounts and assets. Best practices recommend that the user themselves generate the phrase during device setup, write it down privately, and store it in a secure location. Neither the manufacturer nor any party should pre-populate or supply this phrase to the customer alongside the device.
Attackers can exploit the process by intentionally preparing wallets with a known phrase and distributing them to unsuspecting buyers. Once the device is used and funded, the attacker has the information needed to access and empty those accounts at any time.
Hardware wallets produced by reputable companies generate a unique recovery phrase on first use and never ship with a phrase already provided. Users encountering a wallet with a pre-filled phrase are advised to consider the device compromised and to avoid depositing funds.
Mini dictionary: Ledger, a leading manufacturer of hardware wallets used for securely storing cryptocurrencies, is widely recognized for its devices such as the Ledger Nano S and Ledger Nano X, which enable users to manage digital assets offline.
Supply chain concerns with Southeast Asian reseller
The recent losses have been linked to a suspected supply chain compromise involving Ledger devices distributed by CryptoBilis, a reseller based in Southeast Asia. Reports suggest losses have already surpassed $86 million, with later estimates approaching $90 million.
| Reported losses | Initial claim | Main distributor involved |
|---|---|---|
| $86 million to $90 million | $90 billion | CryptoBilis |
Available data significantly contradicts claims of $90 billion in stolen funds. The incident appears to specifically affect devices supplied through the mentioned distribution channel, and not all Ledger products have been implicated. Authorities are continuing to investigate how compromised devices reached end-users.
Steph Is Crypto emphasized the importance of verifying that a hardware wallet generates a recovery phrase on setup, as receiving one with a pre-written phrase greatly increases the potential for security breaches.
The incident has prompted renewed calls for hardware wallet users to exercise vigilance when purchasing devices and to immediately reject any hardware wallet arriving with a pre-filled recovery phrase.
