A sealed box is not a security boundary. It is a cardboard hypothesis.
The device was opened on camera. Inside, next to the battery and the Secure Element that the entire product category is named after, sat a daughterboard nobody ordered โ traces running in parallel with the display ribbon and the keypad membrane. Not a firmware exploit. Not a poisoned dependency in some JavaScript library. A physical tap, wired between the human and the chip that is supposed to be the last line of defense.
The wallet passed its own authenticity check. It would have passed yours. The 24-word mnemonic was captured in cleartext at the moment of generation and pushed out of band, and the Secure Element โ that expensive, certified, tamper-resistant silicon โ behaved exactly as specified. It never failed. It was never asked the right question.
Ledger's eventual concession is the sentence worth pinning to the wall: Genuine Check cannot detect an implanted board so long as the original secure chip is intact. The ritual the company spent a decade teaching โ plug in, trust the screen, trust the checkmark โ verifies that the chip is Ledger's. It does not verify that the device is unmodified. Those are different claims, and the distance between them is where a reported ninety million dollars of user funds now sits, or doesn't.
Start with the mechanics, because the marketing buried them.
A consumer hardware wallet is a Secure Element, a general-purpose microcontroller, a display, a keypad, and a USB bridge, wrapped in a bill of materials that lands near fifteen dollars and sold for a hundred and fifty. The margin is not theft. It is the price of a claim: key material is generated inside the SE, never crosses the MCU bus in cleartext, never leaves over USB, and every transaction is confirmed on a display the host machine cannot lie to.
That claim rests on three assumptions. Only two of them are cryptographic.
One: the Secure Element is uncompromised. Two: the display tells the truth. Three: the object in your hand is the object that left the factory.
The first two are enforced by silicon and by design review. The third has never been enforced by anything except logistics. There is no signature over the enclosure. There is no attestation over the number of boards inside the case. Custody runs from a fab, through an assembly house, through a regional distributor, through a reseller, through a postal service, into your palm โ and at no point in that journey does the device emit a proof that it is still itself.
That is not a Ledger-specific flaw. It is the structural weakness of every self-custody product sold as a physical good. To reach two hundred countries you rent other people's logistics. The distributor margin is thin, the audit surface is thinner, and the incentive to open a pallet of sealed boxes is approximately zero until somebody films themselves doing it.
There is precedent, and it was ignored. December 2023 was a software supply-chain event โ a poisoned JavaScript connector that drained wallets through the browser, patched in days. This is the same category of failure, moved down a layer, where no patch exists. The company also spent years arguing that its subscription key-recovery service was safe because the shards were encrypted and distributed. Every one of those arguments required the user to extend trust one hop further than the hardware model promised. The implant is what happens when that habit compounds.
Trezor's answer has always been open firmware โ auditable, reproducible, community-reviewed. It is a real advantage, and it is entirely orthogonal to the attack that actually occurred. Open source protects the code path. It does not protect the ribbon cable between the keypad and the chip.
2017 vibes. Proceed with skepticism.
Where the board actually sits
The Secure Element does not talk to your fingers. The MCU does. The SE sits on an SPI bus and does three things: holds the seed, signs, and answers challenges. The MCU scans the keypad, drives the display, and brokers USB. Every byte a human reads or types transits the MCU.
Which means you do not need to break the SE. You need to watch the bus.
A passive tap on the display and keypad lines sees the seed in cleartext during the backup ceremony โ because the ceremony is designed to show it to you, one word at a time, in a fixed order. It sees the passphrase as you type it. It sees the destination address on the confirmation screen, and an active tap can rewrite that screen before you ever read it, because the display is downstream of the injection point. The user verifies the address on the trusted screen. The trusted screen is the thing that was compromised.
No glitching. No fault injection. No decapping, no months in a lab, no conference paper. A four-dollar part, a soldering iron, and access to the box before you do.
This is a downgrade in attacker capability, and that is the part the industry has not absorbed. Historically, extracting a seed from a certified SE meant a well-funded laboratory and a lot of luck. Now it means a manufacturing step performed by someone with a reflow oven and a purchase order.
What Genuine Check actually proves
The verification exchange is roughly this:
nonce = random(32) sig = SE.sign(nonce, vendor_key) ok = verify(sig, vendor_pubkey)
Nothing in that exchange observes the PCB revision, the layer count, the added components, the enclosure seals, or the number of devices answering on the bus. It is an identity proof. It answers "is this chip ours." It does not answer "is this device unmodified."
I have made this exact mistake on a bench. In 2021 I spent three weeks with a Nano X under a microscope, tracing the attestation path because I wanted to know whether the check terminated at the SE or somewhere upstream. It terminates at the SE. I wrote it up as a theoretical gap, filed it under "requires physical access to a sealed unit," and moved on โ because I assumed sealed meant controlled. That assumption was mine, and it was wrong, and it is the same assumption every buyer makes at checkout.
Attestation of identity is not attestation of integrity. The industry has been selling the first as the second for eight years, and the gap was documented, in public, by people who were told they were being paranoid.
What a real check would look like
It is not difficult to specify. It is expensive to ship.
You need a signed measurement chain that starts below the MCU โ firmware hash attested by the SE, so an added microcontroller cannot answer the challenge on the real one's behalf. You need a tamper mesh on the PCB itself, so opening the case breaks a detectable circuit. You need the enclosure serial bound to the SE's public key at manufacture, published in a database the buyer can query offline. And you need the backup ceremony to accept externally generated entropy, so the seed never has to appear on a screen the vendor cannot prove is clean.
That last item is the cheapest and the most effective, and almost nobody does it. A seed rolled with dice and restored into the device via a verifiable path is immune to a display tap. A seed generated on the device and displayed for transcription is not.
The industrialization signal
The implanted boards were reportedly batch-produced. That single word changes the threat model.
A hand-modified unit is a targeted attack: one victim, one balance worth the effort, plausible deniability, no tooling cost to amortize. Batch production implies tooling, implies a supply chain nested inside the supply chain, implies somebody expected to move thousands of units through a channel and get paid per unit. The population of affected devices is almost certainly larger than the population disclosed, because nobody has run independent forensics on the secondary market, and nobody has run it on the refurbishment channel at all.
The knowledge-timing problem
The timeline is the part that will decide the legal outcome, and it is also the part with a hole in it.
The disclosure thread carries an October 17, 2026 timestamp. The defense references a security guidance article dated March 6, and an update in September. Karpelรจs initially claimed Ledger had said nothing, then corrected himself: Ledger did publish an academy article in March.
The correction matters more than the original claim. It narrows the dispute from concealment to sufficiency โ was a knowledge-base post adequate warning for a physical implant inside a shipped product? Concealment is a scandal. Insufficiency is a liability. The damages differ by an order of magnitude, and so does the remedy.
I will not resolve the date discrepancy here. I will say that any forensic timeline mixing a March disclosure, a September revision, and an October accusation needs an independent anchor before it goes into a filing.
Under European product-safety rules, the operative question is not intent but adequacy of warning and post-market surveillance. A distributor suspension is a remediation act, and remediation acts are admissions that a defect class existed. Counsel on both sides will read the same paragraph and reach opposite conclusions.
The ninety million
Treat the figure as a claim until an on-chain attribution exists. But read its shape. A number that size implies hundreds of affected users holding size, which is precisely the demographic a hardware wallet is built for: offline, high-balance, low-frequency. The people least likely to notice a drain and most likely to have moved a seven-figure position through a device they bought from a reseller to save twelve dollars on shipping.
The response as signal
The CEO's reply invoked Mt. Gox and the 850,000 missing coins. That is an ad hominem, and in crisis terms it is a statement of position: when you cannot rebut the mechanism, you attack the messenger's history. Karpelรจs carries real baggage โ he ran the exchange that lost the largest pile of Bitcoin ever lost โ and that baggage is now functioning as a rhetorical shield. It does not make the teardown wrong. It does make the audience's discount rational, and the company knows it.
Meanwhile the structural cause sits untouched: a distributor layer that exists to save maybe eight points of gross margin on a device whose entire value proposition is that nobody touched it.
Entropy wins. Always check the fees.
The Layer2 angle nobody is pricing
Here is where my day job makes me less calm than the average commentator.
Bridge multisig signers run consumer hardware wallets. Sequencer keys, upgrade keys, treasury keys โ the operational security of a nine-figure rollup often terminates in a Nano in somebody's desk drawer, purchased through a corporate procurement channel that did exactly zero vendor verification. If the implant class is real and batch-produced, the systemic exposure is not retail users losing a seed. It is a threshold signature scheme whose k-of-n participants were compromised at the hardware layer before the ceremony ever happened, which means the threshold was never k-of-n at all.
Nobody has published a signer-hardware inventory for the top twenty rollups. I have asked. The answers are evasive, which is itself an answer.
The blind spot
Everyone is litigating Ledger's honesty. That is the wrong question, and it is being asked because it is the comfortable one.
The uncomfortable finding is this: the industry replaced a proof with a certificate, then marketed the certificate as a proof. Genuine Check was never cryptography in the sense that matters. It was a brand signature. And brand signatures fail exactly the way brands fail โ quietly, at the edges, in the last mile where the margin is thinnest and the oversight is cheapest.
The second blind spot is the assumption that open source is a defense. Trezor is not immune to a bus tap. It is differently exposed, and it deserves credit for shrinking its distributor network while its competitor was still drafting statements, but auditable firmware does not audit a ribbon cable. Anyone telling you otherwise is selling a category, not a threat model.
The third blind spot is the panic migration. Some fraction of users will respond by moving balances back to exchanges, which trades a physical supply-chain risk for a counterparty risk with a far better track record of actual loss. Impermanent loss is real. Do your math โ including on the custody you rent instead of own.
Takeaway
The next vector is not the factory. It is the refurbishment and RMA channel, where devices re-enter circulation with no chain of custody at all, and the secondary market, where a sealed box is worth more than an open one and nobody checks a serial against a manufacturer database.
What actually helps, in order of leverage: generate seeds out of band on entropy you control and restore them into the device rather than accepting a device-generated seed; bind every unit's serial to its SE attestation so a reseller cannot swap enclosures; demand tamper-evident packaging with per-unit seals, not per-carton; verify the receive address on a second, independent screen; keep balances dispersed across vendors and generations.
None of that is a fix. It is loss reduction.
So the question I keep landing on: if the last line of defense is a cardboard box, a checkmark, and a distributor's warehouse, what precisely are you custodying?