Can crypto users trust the supply chain behind hardware wallets?

Ordinary cryptocurrency owners cannot realistically be expected to detect sophisticated tampering with hardware wallets, security researcher Joe Grand told Cointelegraph on Tuesday.

Grand specializes in hardware security and has helped recover cryptocurrency from locked wallets. His work includes developing techniques to bypass security protections and extract data from memory chips used in wallets made by Trezor and KeepKey.

“It’s really hard to explain to people how they’re supposed to look at their devices, because even technical people like me are not looking at every single device to see if it’s been tampered with,” Grand said.

The concerns surfaced Friday after crypto losses were reported involving Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines. Ledger confirmed Saturday that one affected device contained an unauthorized implant.

Malicious implants in Ledger wallets sold by CryptoBilis captured users’ recovery phrases and transmitted them over cellular networks, the French hardware wallet maker said.

More control doesn’t mean less trust

Hardware wallets are designed to keep private keys offline, reducing exposure to online attacks that can target software wallets. Some hardware wallets have achieved global popularity, and their distribution networks have created opportunities for supply-chain tampering.