Supply-Chain Attacks on Signing Devices

A signing device protects a key that was generated on it. If someone interfered with the device before it reached you — replacing it, altering its firmware, or arranging for it to produce a key they already know — every downstream protection is decoration. This attack requires no exploit and no user error, and it is why where you buy the device is a security decision.

The three shapes

Pre-seeded devices are the crudest and most effective. The package contains a card with a seed phrase already printed, and instructions saying to use it. The device is genuine, the phrase is valid, and the attacker generated it. Any funds sent to the resulting wallet are immediately spendable by them.

The reason this works is that it inverts the one habit users have been taught: write down the phrase the device shows you. A pre-printed phrase looks like the manufacturer being helpful, and a novice has no basis to distinguish it from legitimate packaging.

Modified firmware is more sophisticated: a genuine device flashed with code that generates keys from reduced entropy, so the attacker can search the small space of possible seeds later. The device looks and behaves correctly, the phrase is unique, and the wallet is compromised from the first block.

Counterfeit hardware replaces the device entirely with something that resembles it. This has grown harder as devices adopt attestation, and it remains viable against buyers who never verify.

Which checks actually help

Tamper-evident seals are close to worthless on their own. Holographic stickers are manufactured in bulk and available to anyone, and users have no reference for what an intact one looks like on a device they have never seen. A device arriving with a seal is not evidence; a device arriving with an obviously broken one is only evidence that the attacker was careless.

Genuine-device attestation is meaningful when it is cryptographic. The device proves possession of a key installed at manufacture, verified against the manufacturer's servers by their software. It is a real check against counterfeits, and it depends on trusting the manufacturer's infrastructure — which is a smaller thing to trust than an unverified package.

Firmware verification is the strongest technical check. A device that reports its firmware version and hash, verifiable against published values and ideally against a reproducible build, tells you what code you are running. Modified firmware fails this check specifically.

And the one that always works: generate the seed yourself, on the device, after you receive it. Whatever happened in transit, a phrase created on your device after a factory reset that you initiated is a phrase nobody else has seen.

The rule that covers the crude attack completely

Never use a seed phrase you did not watch the device generate.

Not a phrase on a card in the box. Not one in a printed manual. Not one supplied by support. Not one on a website. If the words did not appear on the device's own screen during a setup you started, they are worthless to you and valuable to someone else.

This single rule defeats the pre-seeded attack entirely, which is the variant that has taken the most money from the fewest sophisticated attackers.

Reducing the exposure

• Buy from the manufacturer directly or from a distributor they list. Marketplace listings, including those fulfilled by the platform, have repeatedly been the vector.
• Run the manufacturer's attestation check before setup, and treat a failure as final rather than as a support ticket.
• Verify the firmware version and hash against published values before generating anything.
• Factory reset the device yourself and generate the seed on it, regardless of how it arrived.
• Send a small amount first and confirm you can move it out again before funding properly.

Why the last step matters

Every check above can be defeated by a sufficiently resourced attacker, and none of them are things a non-expert performs confidently. A small test transaction, sent and then withdrawn, exercises the whole arrangement end to end and costs the price of two network fees.

It does not prove the key is unknown to anyone else — a patient attacker waits. But combined with generating the seed yourself, it converts the security question from a set of checks you may have done wrong into a property you established by doing it.