Install Chain Insights
← All stories

Safety Academy · Story 14 · Fake hardware wallets

Brand-new box. Second-hand secret.

Penny’s new hardware wallet comes suspiciously ready to use.

Estimated 4 min read

FAKE HARDWARE WALLETS6 scenes

Penny receives a discounted hardware wallet.

A discounted hardware wallet arrives from an unverified marketplace seller. Penny opens the sealed-looking box and finds a device, a PIN and a completed recovery card.

Penny
“The box is sealed. That means safe, right?”
Illustration: Penny receives a discounted hardware wallet.

Packaging and a low price cannot establish that a device is genuine.

The recovery words are already filled in.

The seller calls it convenient pre-configuration. Someone else created those recovery words and may keep a copy. The scammer’s customer service has thoughtfully included himself as another owner.

The Scammer
“I even did the setup for her. Very considerate.”
Illustration: The recovery words are already filled in.

Someone who supplied the recovery phrase may already hold the same keys.

She is about to send 1,000 USDC to it.

Penny is about to move 1,000 USDC into cold storage. The supplied card makes her pause. A hardware device cannot protect funds from someone who already knows their recovery phrase.

Penny
“Cold storage. Warm welcome. One big problem.”
Illustration: She is about to send 1,000 USDC to it.

A device does not protect funds from someone who already knows its recovery phrase.

Captain Harold checks both device and companion app.

Captain Harold checks the purchase route, official companion software and the maker’s authenticity procedure. A “genuine” message inside unverified software would not settle the question.

Captain Harold
“Someone already knows this secret. That rather spoils the secret.”
Illustration: Captain Harold checks both device and companion app.

Do not rely on a “genuine” message shown by unverified companion software.

Penny stops using the suspect device.

Penny does not fund the suspect unit or reuse its words. She follows the maker’s return and replacement process, then uses trusted setup to create a fresh secret herself.

Penny
“This wallet came with an extra owner.”
Illustration: Penny stops using the suspect device.

Create a fresh recovery secret during trusted device setup. Do not reuse a supplied phrase.

Her 1,000 USDC never enters the shared wallet.

The 1,000 USDC stays out of the shared wallet. The return label proves more useful than the prewritten card. Secure setup begins with knowing who created the secret.

Penny
“The most useful feature was the return label.”
Illustration: Her 1,000 USDC never enters the shared wallet.

The habit: verify the device and software, and never accept somebody else’s recovery phrase.

The useful bit

A sealed box and a pre-written recovery card do not make a device safe.

  1. Buy from the maker or a seller it names. A sealed box proves nothing.
  2. A card with recovery words already written on it means someone else has them. Never fund that wallet.
  3. Stop using a suspect device. Set up a new one so it creates fresh recovery words that only you have seen.

I already did this

If you funded the supplied phrase, treat its wallet as compromised. Stop using the suspect unit. Follow the maker’s replacement process and incident guidance to protect remaining assets with a fresh secret from trusted setup. Resetting the device cannot erase someone else’s copy.

Sources & further reading