Plan ₿ Forum 2026 · Lugano · Oct 23–24
Bitcoin Hub

Hardware Wallet Implant & Weak Entropy: What To Do

What Ledger confirmed about the implant in devices sold by CryptoBilis, what is only reported, the Coldcard entropy bug, and four steps: verify firmware, add dice entropy, never type your seed online, buy from the official store. Not investment advice.

English · ~1 min · Published 2026-10-13

Share this page

Key takeaways

  • What Was Reported. Ledger says some of its wallets sold by the reseller CryptoBilis contained a hidden hardware implant.
  • Why It Matters. A seed is only safe if it is truly random.
  • What To Do Now. Keep firmware updated and verify your device.

Full transcript

What Was Reported

Ledger says some of its wallets sold by the reseller CryptoBilis contained a hidden hardware implant. Ledger says it read the recovery phrase from the screen during setup and sent it over a mobile network. Researchers also reported tampered devices from shops in Europe. Ledger is still examining those reports. Separately, in July, Coinkite disclosed and fixed a firmware bug that weakened Coldcard seed generation.

Why It Matters

A seed is only safe if it is truly random. Weak entropy lets attackers recreate keys offline. A supply chain attack happens before the device reaches you. The math stays strong, but hardware can be changed. Ledger says the implant did not modify its secure chip or software. It watched the screen. So one device should not be your only line of defense.

What To Do Now

Keep firmware updated and verify your device. Coldcard seeds made on affected firmware should be replaced. When creating a new seed, consider adding your own dice rolls. Never type your seed phrase into a website, app, or chat. Buy only from the official store. This video is not investment advice.

FAQ

What is this video about?
What Ledger confirmed about the implant in devices sold by CryptoBilis, what is only reported, the Coldcard entropy bug, and four steps: verify firmware, add dice entropy, never type your seed online, buy from the official store. Not investment advice.
What Was Reported?
Ledger says some of its wallets sold by the reseller CryptoBilis contained a hidden hardware implant. Ledger says it read the recovery phrase from the screen during setup and sent it over a mobile network. Researchers also reported tampered devices from shops in Europe. Ledger is still examining those reports. Separately, in July, Coinkite disclosed and fixed a firmware bug that weakened Coldcard seed generation.
Why It Matters?
A seed is only safe if it is truly random. Weak entropy lets attackers recreate keys offline. A supply chain attack happens before the device reaches you. The math stays strong, but hardware can be changed. Ledger says the implant did not modify its secure chip or software. It watched the screen. So one device should not be your only line of defense.
What To Do Now?
Keep firmware updated and verify your device. Coldcard seeds made on affected firmware should be replaced. When creating a new seed, consider adding your own dice rolls. Never type your seed phrase into a website, app, or chat. Buy only from the official store. This video is not investment advice.
Is this investment advice?
No. The video explains how Bitcoin works and does not tell you to buy or sell anything.

Go deeper on the site

More videos

Not investment advice.