A hardware wallet is one of the strongest tools for protecting private keys in self-custody, and the scams around it almost never touch the chip. They work on the seller, the box, the companion app, and the mailbox. In 2026, the companion app became the expensive one. Published for Cybersecurity Awareness Month 2026.

In short: A genuine hardware wallet arrives with a blank recovery sheet, and the device generates the words in front of you. A card that already has words on it, an unrequested “replacement” device, a companion app that asks for your 24 words, or a letter with a QR code is a scam. In April 2026, a fake Ledger Live in Apple’s Mac App Store took about $9.5 million in a week by asking for exactly that. The check never changes: the phrase is created on the device and typed nowhere else.

A sealed box, a scratch-off card, 24 words that were not yours

In January 2018, a Ledger buyer posted on Reddit that his coins had vanished. The device had come sealed, with a recovery sheet whose 24 words sat under a silver scratch-off coating, as if the manufacturer had printed them. He used the words, loaded the wallet, and the seller emptied it. Ledger’s chief executive at the time, Eric Larchevêque, called it a low-tech scam: the device had not been tampered with, because nothing needed tampering. The seller had initialized it, printed the phrase, and relied on a newcomer not finding a predefined seed strange. eBay purchase coverage put the loss at about £25,000.

Ledger’s own warning page is explicit: its documentation includes no pre-existing seed words or PIN, and a device that arrives with them may already have been used by somebody else.

Why a pre-filled sheet is the entire scam

The security of a hardware wallet rests on one fact: the recovery phrase is generated inside the device and shown only on its screen. Whoever knows the words controls the funds from any other wallet, anywhere, without the device. A seller who writes the words down before shipping has already copied your keys. They can wait weeks for a balance to build, then sweep it from a device you have never seen. There is nothing to hack and nothing to detect on the hardware itself.

When the device really is counterfeit

Some scams do touch the hardware. In May 2023, Kaspersky published a case study of a Trezor Model T bought from a “trusted seller” on a classifieds site. The device looked and worked like a genuine Model T. Inside, the microcontroller had been replaced with one that let the attackers control the private keys, and the funds disappeared without the wallet ever being plugged into a computer. Cointelegraph noted that Trezor had publicly addressed tampered Model T devices a year earlier, in May 2022.

The 2021 version arrived by post. After Ledger’s July 2020 customer-data breach, some customers received a shrink-wrapped Nano X box with a letter, purportedly from Ledger’s CEO, offering a replacement device. Ledger confirmed the device was fake: a flash-drive implant on the circuit board held a counterfeit Ledger Live that asked the user to type in their 24 words, as BleepingComputer reported and Bitdefender summarized. A real Nano is not a USB storage device, and no setup ever asks for the phrase on a computer.

The companion app is the softer target, and in 2026 the most expensive one

If the device is hard to fake, the software beside it is easy. Between April 7 and April 13, 2026, a counterfeit Ledger Live sat in Apple’s Mac App Store under a publisher with no connection to Ledger, as AppleInsider reported from BleepingComputer’s findings. People setting up or restoring a wallet on a new Mac downloaded it, and it asked for the recovery phrase. By investigator ZachXBT’s count, about $9.5 million left more than 50 victims across Bitcoin, Ethereum, Solana, Tron and XRP in six days; three of them lost seven-figure sums, including $3.23 million in USDT in a single transfer. Apple removed the app in mid-April. Ledger’s chief technology officer, Charles Guillemet, told Cointelegraph that the company never asks for the 24 words and that an official-looking software environment, “not your browser, not your app store, not your desktop,” should be treated as safe by default.

The pattern was not new, only the venue and the scale. On November 5, 2023, ZachXBT had flagged an app called “Ledger Live Web3” in Microsoft’s store that had been listed since October 19. By his count, 16.8 BTC, about $588,000, left victims in 38 transactions, and a further $180,000 or so in ETH and BNB Chain tokens brought the total to about $768,000; Microsoft removed the app the same day, according to Bitdefender and ESET. In 2025, Moonlock Lab reported that macOS infostealers, including Atomic macOS Stealer and Odyssey, replaced the real Ledger Live with a trojanized copy that showed a fake “suspicious activity” alert and asked for the phrase. And in August 2026, a Trezor analyst told U.Today that people searching “Trezor wallet” clicked the sponsored result at the top of Google and landed on a fake Trezor Suite built on Google Sites that asked for their seed phrase. Store listing, search ad, infostealer: the delivery changes, the request does not.

Phishing by post

In April 2025, Ledger owners began receiving letters on company letterhead with a reference number and a QR code, instructing them to complete a “mandatory wallet validation” by entering their recovery phrase. Ledger confirmed the letters were a scam and repeated its standing line: it will never call, message, or ask for the 24 words. Cointelegraph tied the targeting to customer data leaked in 2020.

The letters kept coming. BleepingComputer documented a Ledger letter demanding a “Transaction Check” by October 15, 2025, and a Trezor letter with a hologram setting an “Authentication Check” deadline of February 15, 2026. In February 2026, Cointelegraph reported a new wave after a security researcher received one. The QR codes led to copies of the vendors’ setup pages, and the final page asked for the phrase.

What gives it away

The recovery sheet is not blank. The device does not ask you to generate a phrase, or it already shows one. Setup happens on a computer screen rather than the device screen. An app or website asks for all 24 words. A device, a letter, or an “update” arrives that you did not request. Any one of these is enough to stop.

This pattern maps to two Cybersecurity Awareness Month habits: multi-factor authentication and software updates. A hardware wallet keeps private keys isolated from your everyday devices and requires physical interaction to authorize transactions. The companion app and firmware are the software you keep updated, and only ever from the vendor’s own channel.

The check: six things before the first deposit

• Buy from the manufacturer or an authorized reseller named on its site. Marketplace listings and “trusted sellers” on classifieds sites are where the documented cases began.

• Expect a blank recovery sheet. If a device arrives pre-initialized or with a recovery phrase already provided, do not use it or deposit funds. Contact the manufacturer through its official support channel and arrange a return or replacement.

• Generate the phrase yourself, on the device screen, and write it down by hand. Follow the manufacturer’s official recovery instructions for your specific device. Never enter your recovery phrase into a website, unsolicited prompt, or unverified application.

• Install the companion app only from the vendor’s website, never from an app-store search, a sponsored search result, or a link in a message, and verify the download’s checksum where the vendor publishes one. The April 2026 app was in Apple’s own store; the August 2026 Trezor Suite was the top result on Google.

• Run the vendor’s genuine-device check through its official software before depositing, then send a small test transaction first.

• Treat any unsolicited device, letter, email, or update prompt that mentions your recovery phrase as a scam, and report it to the vendor.

What the check does not prove

A blank recovery sheet is expected, but it does not prove the device is new or genuine. A device may have been modified without any visible signs of tampering. An authenticity check proves the firmware is official on the day you run it, not that the app on your computer is. Each layer covers one failure. None covers the moment you type the phrase into something that asked for it.

Where this meets your swap

A hardware wallet and a self-custodial swap aggregator fit together well: the wallet signs, SimpleSwap routes, and the result lands in a wallet you own. SimpleSwap can’t inspect your device, your companion app, or your mailbox. A transaction signed with a pre-seeded phrase is valid, and no service can reverse it.

We can keep the same rule on our side of the swap. Nothing in a SimpleSwap order ever asks for a recovery phrase, and our support never messages first; the Safety Academy covers the look-alike apps and sites that do. Our only official domain is simpleswap.io.

FAQ

What should I do if my hardware wallet came with a recovery phrase already written down?
Do not use the device as delivered. Someone else generated that phrase and holds a copy. Reset the device, generate a new phrase on its screen, and report the seller to the manufacturer; Ledger’s guidance says the same.

Is it safe to buy a hardware wallet on a marketplace or classifieds site?
The documented cases, from the 2018 scratch-off card to Kaspersky’s 2023 counterfeit Trezor, all began with third-party sellers. Buy from the manufacturer or a reseller it names on its own site, and run the genuine-device check before the first deposit.

Does Ledger or Trezor send letters asking me to verify my wallet?
No. Both companies have said they never ask for a recovery phrase through any channel, and Ledger confirmed in April 2025 that letters with QR codes requesting the phrase are a scam. You enter a phrase only on the hardware device itself during setup or recovery.

Where is the real Ledger Live or Trezor Suite app?
On the vendor’s own website, and nowhere else. In April 2026, a counterfeit Ledger Live in Apple’s Mac App Store took about $9.5 million from more than 50 people in six days, and in August 2026 a fake Trezor Suite sat at the top of Google’s sponsored results. A companion app that asks for your seed phrase is a scam, no matter where you found it.

This article is for educational purposes only and is not financial or investment advice. The services and tools named here are examples, not endorsements, and none replace your own judgment. SimpleSwap’s only official domain is simpleswap.io.