Hardware Wallet Implant & Weak Entropy: What To Do
What Ledger confirmed about the implant in devices sold by CryptoBilis, what is only reported, the Coldcard entropy bug, and four steps: verify firmware, add dice entropy, never type your seed online, buy from the official store. Not investment advice.
English · ~1 min · Published 2026-10-13
Key takeaways
- What Was Reported. Ledger says some of its wallets sold by the reseller CryptoBilis contained a hidden hardware implant.
- Why It Matters. A seed is only safe if it is truly random.
- What To Do Now. Keep firmware updated and verify your device.
Full transcript
What Was Reported
Ledger says some of its wallets sold by the reseller CryptoBilis contained a hidden hardware implant. Ledger says it read the recovery phrase from the screen during setup and sent it over a mobile network. Researchers also reported tampered devices from shops in Europe. Ledger is still examining those reports. Separately, in July, Coinkite disclosed and fixed a firmware bug that weakened Coldcard seed generation.
Why It Matters
A seed is only safe if it is truly random. Weak entropy lets attackers recreate keys offline. A supply chain attack happens before the device reaches you. The math stays strong, but hardware can be changed. Ledger says the implant did not modify its secure chip or software. It watched the screen. So one device should not be your only line of defense.
What To Do Now
Keep firmware updated and verify your device. Coldcard seeds made on affected firmware should be replaced. When creating a new seed, consider adding your own dice rolls. Never type your seed phrase into a website, app, or chat. Buy only from the official store. This video is not investment advice.
FAQ
- What is this video about?
- What Ledger confirmed about the implant in devices sold by CryptoBilis, what is only reported, the Coldcard entropy bug, and four steps: verify firmware, add dice entropy, never type your seed online, buy from the official store. Not investment advice.
- What Was Reported?
- Ledger says some of its wallets sold by the reseller CryptoBilis contained a hidden hardware implant. Ledger says it read the recovery phrase from the screen during setup and sent it over a mobile network. Researchers also reported tampered devices from shops in Europe. Ledger is still examining those reports. Separately, in July, Coinkite disclosed and fixed a firmware bug that weakened Coldcard seed generation.
- Why It Matters?
- A seed is only safe if it is truly random. Weak entropy lets attackers recreate keys offline. A supply chain attack happens before the device reaches you. The math stays strong, but hardware can be changed. Ledger says the implant did not modify its secure chip or software. It watched the screen. So one device should not be your only line of defense.
- What To Do Now?
- Keep firmware updated and verify your device. Coldcard seeds made on affected firmware should be replaced. When creating a new seed, consider adding your own dice rolls. Never type your seed phrase into a website, app, or chat. Buy only from the official store. This video is not investment advice.
- Is this investment advice?
- No. The video explains how Bitcoin works and does not tell you to buy or sell anything.
Go deeper on the site
More videos
- What Is Bitcoin? A Simple Explanation for Beginners
- What Is the Bitcoin Orange Pill? Explained Simply
- How to Buy Bitcoin: A Simple Beginner's Guide
- What Is Bitcoin Mining? Explained Simply
- The Bitcoin Halving Explained: 50 → 3.125 BTC
- Bitcoin Wallets Explained: Hot vs Cold, Keys and Seed Phrase
Not investment advice.