A hole poked by a dealer: a liability cap of 100 USD cannot cover a loss of 90 million

Author: Gu Yu, ChainCatcher

On the afternoon of October 13, Ledger issued its longest official update since the incident, detailing the attack method down to the component level: the implanted module is hidden inside the device casing, "reading the data displayed on the screen"------during initialization, the device displays a 24-word mnemonic on the screen, which the module recognizes and decodes via the microcontroller, then sends out through a pre-configured eSIM via LTE.

More critically, a clarification followed closely: the implanted module is an independent component, does not modify the secure element, does not modify the operating system, and does not change transactions or signatures. The chip is real, the system is original, and every transaction is confirmed by the user------the checks taught to users by the industry, and all these devices passed. The mnemonic only appeared on the screen for those few seconds, but it had an extra pair of eyes.

However, this update only answered "what happened inside the device," and did not address "what about the people who lost money." Among the 164 replies, the most liked follow-up questions were almost all asking the same thing: if a device bought from an official authorized dealer was tampered with and resulted in financial loss, would Ledger take responsibility and compensate? What about users from the EU MediaMarkt channel? Ledger's stance is: all confirmed financial losses involve devices sold by CryptoBilis, while other channels are "yet to be verified."

Four days ago, it was merely "a problem with a dealer of a certain company"; now, it has become a question that the entire hardware wallet industry must answer together: who is responsible for the integrity of the device from the moment it leaves the factory?

I. From a Dealer to a Chain

On October 9, users in Southeast Asia reported that assets were transferred away; on October 10, Ledger confirmed that one affected user's device contained unauthorized hardware implants, marking the first physical evidence obtained; on the same day, CryptoBilis announced a suspension of sales and shipments of Ledger devices. An authorized dealer, a batch of affected users, a cut------the narrative up to this point is almost complete.

But in the following days, every new clue expanded this framework.

The first anomaly lies in the devices themselves. Most of the confirmed modified devices are brand new, not returned units. The industry's default risk model has always been "user buys a new device---device is modified---returned---next customer gets hit," which assumes that modification occurs after the sale; the fact that brand new devices have been tampered with means that the modification happened before the device reached any user------the problem shifted from "a link in the channel" to "a step in the warehouse."

The second anomaly is the craftsmanship. Karpelès compared early samples with the latest ones in a blog post: the former showed obvious signs of handcrafting, while the latter appeared to be produced on demand. If this observation holds, the tampering was not a spur-of-the-moment decision by an individual, but a chain capable of mass-producing implanted modules. The figures on the chain are also being revised upwards: Specter initially estimated over $86 million, while Bitquery's analysis on October 12 across 324 wallets and multiple chains estimated about $102 million------yet Ledger has only stated: "We have not yet confirmed the total number of affected users or the total value of losses."

Then the clues began to cross borders. On the European side, user Johannes reported buying two modified devices from two different MediaMarkt stores, and he asked store employees to check the inventory records, finding that at least one came from Aqipa GmbH------a distributor covering all of Europe, potentially affecting areas far beyond Germany. On the Asian side, Karpelès's device was purchased from Amazon Japan, shipped by a Chinese seller, and sent from Malaysia; the Japanese seller channel Nano X reported by research firm Tibane Labs also shipped from Malaysia. Two clues thousands of miles apart point to the same shipping location.

The other end of the chain is equally professional. Tether froze $10 million USDT on the first day, and the attacker immediately exchanged $15 million USDT for USDD, which Tether cannot freeze, then exchanged back for about $5.1 million USDT, of which about $4.23 million flowed into a Binance deposit address; 2810 ETH entered Tornado Cash in three rounds. As of October 11, there were still 15,475 ETH, 203 BTC, and $10 million USDT in the hands of the attacker. CZ proposed a more radical speculation------that the attacker bought this dealer and had them sign a confidentiality agreement to remain silent; this claim has not been verified, but the professionalism of the chain is evident.

Putting these clues together, it is hard to explain it as "accidental": a bought dealer is an incident, a cross-border chain capable of mass modification and evading freezes is a vulnerability. The former can be dealt with by cutting lists, the latter cannot. Ledger claims it is developing more robust hardware anti-tampering measures, but has not specified the details or timeline; the self-inspection plan it provided is for users to compare component photos and check the device themselves, while the official tutorial simultaneously warns that opening the device may cause damage. A verification process that requires users to disassemble the device to complete itself indicates that the industry still has no answers.

II. What Are Peers Doing

Beyond the incident, the differences in responses from various manufacturers are even more informative. In fact, CryptoBilis not only sells Ledger but also sells many hardware wallets including Trezor, CoolWallet, Tangem, OneKey, SecuX, and Ellipal.

On the afternoon of the day the incident broke, Keystone's Chinese account published a post promoting the PCI-level self-destruct feature of the Keystone 3 Pro: once physical disassembly or tampering is detected, it automatically erases chip data, rendering the device useless. This tweet garnered 42,000 views. It precisely hit the critical point of this attack------the implanted module must be installed by opening the casing, and self-destruction turns "quiet installation" into "installed and gone." But precisely because it was chosen at this time, it brought an awkward matter to the forefront: the industry has actually always had a technical answer, but no one felt it was necessary to implement it before.

Most manufacturers' first reaction was to distance themselves. Trezor removed CryptoBilis from its authorized list and stopped sales through that channel, while reminding users not to disassemble the device themselves; imKey stated it had not received relevant feedback and would verify authorized channels.

SafePal emphasized that its devices verify authenticity and usage status during the initial setup, issue warnings for previously activated devices, and display the first activation date, using tamper-evident seals to identify whether the packaging has been opened. Tangem went further, making tampering impossible from the ground up: the secure chip and NFC antenna are integrated and sealed, private keys are generated and signed within the chip, and firmware written by the factory cannot be modified------"Whether users purchase through official stores, dealers, or other channels, as long as the App verifies the device as genuine, it ensures that the private key is solely controlled by the user."

But Tangem's statement precisely bypasses the crux: verification, can it self-certify? The fact is, Ledger's Genuine Check can only verify that the secure chip is genuine and cannot detect what physical modifications have been made to the components surrounding the chip------devices with implanted modules can pass authenticity checks. No matter how tightly the channel is managed, it only reduces the probability, not eliminates the risk.

In the face of market skepticism, OneKey announced unconditional free replacements for users who purchased through that channel since March of this year, with no need to return old devices, while re-evaluating all existing dealers, stating that "if the operating entity cannot be verified, or the ultimate beneficiary cannot be clarified, authorization will be revoked," and admitted that "the dealer network will be significantly reduced."

III. $100: The Liability Cap That Was Unearthed

After the news of OneKey's free replacements spread, the community began to scrutinize its user agreement, which ironically led to a large public crisis for OneKey itself.

The current "Service Agreement" Section 15.5 states: if OneKey is determined to be liable to users, its cumulative liability cap shall not exceed the highest of the following three:------(a) the actual purchase price of the device; (b) the fees actually paid by the user for the paid service within the 12 months prior to the incident; (c) one hundred dollars (USD 100). Moreover, this is a "single cumulative cap, and multiple claims, multiple incidents, or multiple legal bases will not increase its amount."

Section 15.4 is even more thorough: to the maximum extent permitted by applicable law, OneKey shall not be liable for any loss or impairment of digital assets, regardless of the cause------the device and App are merely tools for managing keys and do not provide insurance or guarantees for assets. Section 15.6 provides a rationale: the App and most services are free, the device price does not include asset insurance, OneKey never holds users' assets or credentials, nor does it know how much users have stored. Section 15.10 leaves an escape route: OneKey may decide to provide compensation, replacement, or other assistance at its discretion, but any such actions are merely expressions of goodwill, do not constitute an admission of liability, set no precedent, and do not create obligations to anyone, and may require users to sign a disclaimer as a condition.

It should be clarified that this is not just OneKey's practice. OneKey's official has previously listed other hardware wallets that include very low compensation modules in their user agreements. Capping liability at the device price or a small fixed number is a common clause design in the hardware wallet industry. What is truly worth discussing is the mismatch exposed when it is placed alongside "free replacements":

On one side is a new device costing hundreds of dollars, willing to cover active responsibility for 180 days; on the other side is a contract that caps liability at $100 and states "any assistance does not constitute an admission of liability." Both are commercially valid, but users' feelings about them are torn------a company can achieve 120 points morally while only committing to $100 contractually. And this $100 is precisely the only thing that can be brought out when the risk truly falls on the user.

It reflects a structural mismatch of the entire category. The ethical foundation of self-custody is "users keep their own keys, therefore users bear the consequences." This premise has cracked for the first time in this incident: the breached link------from factory to warehouse, from dealer to doorstep------is precisely the part that users cannot control or verify in any way. Responsibility has been entirely placed on the user, while the control of risk lies with the manufacturers.

Hardware wallets have always sold "tools," not "custody." When the tool itself becomes the attack surface, the narrative of "the tool is not responsible" is facing its first real stress test.

IV. 2026: The "Physical Year" of Hardware Wallets

Widening the perspective, this incident is the latest and most costly among a series of issues this year.

In 2026, six hardware wallet brands have disclosed security issues, but only two incidents have actually led to user losses: in July, Coldcard's firmware weak entropy allowed recovery phrases to be inferred, resulting in losses exceeding $115 million according to Galaxy Research; and this time, the supply chain breach at Ledger caused approximately $90 million in losses. The total amounts to about $205 million. The evaluation from the industry analysis agency Wise Advice is: "2026 may become the craziest year in the history of hardware wallet security."

The remaining issues are distributed across different locations on the same chain: in June, Ledger's security team used lasers to penetrate the chip of Trezor Safe 7, and in July, they penetrated Tangem cards (both required laboratory equipment, and Tangem claimed that the risk to ordinary users is "almost nonexistent"); BitBox fixed several firmware vulnerabilities deemed "serious" by its engineers in August, which did not result in losses; Trezor's logistics provider leaked information of 13,689 buyers; SafePal leaked nearly 40,000 home addresses.

This year, no security chip has been truly compromised outside of the laboratory. Attackers bypassed cryptography and turned to adjacent elements—random numbers, logistics slips, warehouses of distributors, and deliveries at users' doorsteps.

The industry is searching for answers, but there is no consensus yet. Yu Xian, founder of Slow Mist, believes that "a self-destruct feature will be a necessary mechanism… otherwise, there needs to be another mechanism to prove that the hardware wallet I have is the product intended by the official"; Mindao counters that once self-destruction occurs, it cannot prove whether the machine has been tampered with, and that being removable at least allows for circuit diagram comparisons, while Ledger officially provides hardware integrity checks at startup, which are just "too hardcore" for ordinary users; others propose the simplest solution—cross-brand multi-signature, with Trezor, OneKey, and Keystone each holding one key, using Sparrow or Electrum for 2/3, "to prevent one party from doing evil."

None of these suggestions is "buy a better chip." They all point to the same thing: the security boundary has expanded from the chip to beyond the chip.

Conclusion

"The private key has never left the device" has been the promise of the hardware wallet industry for ten years. In this incident, it holds true literally, yet is meaningless.

The security component was not modified, the operating system was not altered, every transaction was confirmed by the user themselves, and the 24 words never left that chip. It is meaningless because the key does not need to leave the device—only needs to be glanced at for a few seconds on the screen. What was compromised is not the cryptography, nor even the chip, but the action of "verification" itself: Genuine Check can verify the authenticity of the chip, but cannot verify the eyes next to the screen.

Therefore, the lesson the industry needs to learn is not to tighten channel management, but to let the device testify itself, upgrading the acceptance standard from "the chip is real" to "the whole unit is original"—self-destructing upon disassembly may be transitioning from an option to a standard feature, which is more fundamental than any contraction of a dealer list.

The question of responsibility remains unresolved. The common contractual design in this industry is to make services as heavy as possible while capping cumulative liability to the price of a device or a small fixed number. It is not necessarily about shirking responsibility, but rather a truthful description of the industry's responsibility structure: it creates tools, not manages assets. The real problem is that users have always thought they were buying something other than a tool.