The eBay Ledger that wasn't sealed

March 2025. A holder in Tucson buys a "new in box" Ledger Nano X on eBay for $89 — about $60 under Ledger's $149 list price. The packaging looks pristine. He sets it up, generates a "new" 24-word seed displayed on the device screen, writes it down, transfers $34,000 in BTC to the receive address. Two weeks later, the wallet is drained.

A genuine Ledger running Ledger's own firmware cannot be made to show a known seed as if it were new. The seller had swapped in modified internals that display a preset seed during "setup," then carefully resealed the packaging. Such units generally fail Ledger Live's genuine check — it failed the first time he connected it; he took it for a glitch and set the wallet up in third-party software instead. A cruder version of the same trap skips the hardware work entirely: the box includes a recovery card with 24 words already filled in, and a note telling the buyer to use them.

Why this attack is the hardest to spot

The device works. The setup flow looks normal. The seed phrase is shown on the device screen, exactly as the security model promises, and the one warning that would have caught it is easy to dismiss. The only difference is: the operator knew the seed before the victim ever opened the box. Once the victim funds an address derived from that seed, the operator drains it.

The five rules for hardware wallet purchase

  • Buy only from the manufacturer's website. Ledger: ledger.com. Trezor: trezor.io. Coldcard: coinkite.com. Never eBay, never Amazon (third-party sellers), never Craigslist, never a "trusted friend." The few dollars you save buying elsewhere are the cheapest part of the loss.
  • Reject a "new" device sold well under the official price by anyone but the manufacturer. Ledger does run its own sales, but those happen on ledger.com. A sealed Nano X from a random seller at 40% off is a warning, not a bargain.
  • If you end up with a device that did not come from the manufacturer, a wipe is not enough. Resetting it (three wrong PINs on a Ledger, a factory reset on a Trezor) and generating a new seed only protects you from a previous owner's seed on genuine hardware. It does nothing against modified internals. Run the manufacturer's genuine or authenticity check, and if anything warns, stop and do not fund it.
  • Never use a seed that came in the box. A genuine device always generates the seed itself, on its own screen. A pre-printed or pre-filled recovery card means the device is compromised.
  • Do not rely on the packaging. Seals and stickers can be copied by careful resealers. The software authenticity check that the manufacturer's app runs is a much better signal than how the box looks.

The recovery option

If you suspect a pre-initialized device: do not fund it, not even with small amounts, and do not try to fix it with a reset — a modified device can show a "fresh" preset seed again after a wipe. Set it aside. If funds are already on it, move them right away to a new seed generated on a device bought directly from the manufacturer.

The rule I follow

I don't put money on any hardware wallet that did not come straight from the manufacturer. The high-value device is always direct from the manufacturer, paid by card, shipped to my actual address.