{"id":74020,"date":"2026-10-07T20:04:02","date_gmt":"2026-10-07T17:04:02","guid":{"rendered":"https:\/\/lwallet.com.ua\/?p=74020"},"modified":"2026-10-07T20:04:02","modified_gmt":"2026-10-07T17:04:02","slug":"preset-seed-phrase","status":"publish","type":"post","link":"https:\/\/lwallet.com.ua\/en\/preset-seed-phrase\/","title":{"rendered":"Hardware wallet with a preset seed phrase: risks"},"content":{"rendered":"\r\n\r\n\r\n

You order a hardware wallet from an online marketplace and receive a sealed box with holographic stickers. Inside is a scratch-off card with 24 words printed beneath the coating, and the instructions tell you to enter this \u201cactivation phrase\u201d during setup. Using it restores a wallet whose keys are already known to whoever prepared the card, allowing that person to steal any funds you send to its addresses.<\/p>\r\n\r\n\r\n\r\n

If you receive a wallet with a preset seed phrase, stop the setup and do not send it any funds.<\/strong> Sealed packaging and a highly rated seller do not make that phrase safe. This guide explains how scammers prepare devices for sale and what to do if you have already used the phrase supplied in the box.<\/p>\r\n\r\n\r\n\r\n

How a seed phrase is generated during setup<\/h2>\r\n\r\n\r\n
\r\n
\"Generating<\/figure>\r\n<\/div>\r\n\r\n\r\n

When you choose to create a new wallet, the device generates random data known as entropy. The wallet uses this data to create its keys and a backup that lets you restore access to your funds. With wallets that use the BIP39 standard, you typically write down 12 or 24 words shown on the device\u2019s screen. Modern Trezor devices also support 20-word backups based on SLIP39<\/a>. Our guide to seed phrases and wallet recovery<\/a> explains what these words are for.<\/p>\r\n\r\n\r\n\r\n

Ledger, Trezor, BitBox, and Keystone use different methods to generate and back up wallets, but none requires words supplied by the seller to create a new wallet. The phrase must be generated when you set up the wallet yourself<\/strong> and remain unknown to the manufacturer, the seller, and anyone else.<\/p>\r\n\r\n\r\n\r\n

Treat a preprinted phrase as compromised<\/strong>, because whoever prepared the card saw every word and could have kept a copy before covering it with the scratch-off coating.<\/p>\r\n\r\n\r\n\r\n

New Trezor devices ship without firmware installed. You install it when you first connect the device, and the bootloader verifies its digital signature. If a newly purchased Trezor reports that firmware is already installed, the manufacturer advises contacting support<\/a> before continuing with setup.<\/p>\r\n\r\n\r\n\r\n

How scammers prepare a wallet for sale<\/h2>\r\n\r\n\r\n
\r\n
\"Scammers<\/figure>\r\n<\/div>\r\n\r\n\r\n

A scammer only needs a genuine device and fake instructions to persuade a buyer to use a seed phrase the scammer already knows. The wallet may work normally and pass an authenticity check<\/strong> even though the attacker has a copy of its phrase. The process typically works like this:<\/p>\r\n\r\n\r\n\r\n

    \r\n
  1. The device is set up in advance.<\/strong> The scammer creates a wallet and records its seed phrase, which they can later use to restore the same wallet on another device.<\/li>\r\n\r\n\r\n\r\n
  2. The phrase is printed on a card and covered with a scratch-off coating.<\/strong> It resembles a prepaid top-up card, so a buyer may assume it is a standard part of the package.<\/li>\r\n\r\n\r\n\r\n
  3. Altered instructions are added to the box,<\/strong> describing recovery with the scammer\u2019s known phrase as a mandatory \u201cactivation\u201d step. Someone setting up a hardware wallet for the first time may simply follow those instructions.<\/li>\r\n\r\n\r\n\r\n
  4. The box is resealed.<\/strong> Plastic wrapping and holographic stickers can be bought separately, making the package look as though it has just left the factory.<\/li>\r\n\r\n\r\n\r\n
  5. The wallet is listed for sale,<\/strong> often with a discount or an explanation such as \u201cI received two as gifts and am selling one unopened.\u201d Scammers may also charge the normal retail price.<\/li>\r\n<\/ol>\r\n\r\n\r\n\r\n

    A more sophisticated version uses a counterfeit device with modified firmware that pretends to create a new wallet while supplying words already known to the attackers. The buyer may write the phrase down directly from the screen without realizing it was chosen in advance.<\/p>\r\n\r\n\r\n\r\n

    [vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n\r\n\r\n\r\n

    Plastic wrapping and holographic stickers do not prove that a device is genuine<\/strong>. The counterfeit Trezor Model T examined by Kaspersky had intact stickers; the hardware modifications were discovered only after it was taken apart.<\/p>\r\n\r\n\r\n\r\n

    [\/vc_message]<\/p>\r\n\r\n\r\n\r\n

    Why the funds may not disappear immediately<\/h2>\r\n\r\n\r\n
    \r\n
    \"A<\/figure>\r\n<\/div>\r\n\r\n\r\n

    If the wallet is not protected by an additional secret known as a passphrase<\/a>, a copy of the seed phrase is enough to restore its keys, monitor incoming funds through a blockchain explorer or an automated script, and transfer them out. Changing the PIN does not change the seed phrase.<\/strong> A PIN protects access to a particular device<\/a>, while the scammer can restore the same wallet on another device using their copy of the phrase.<\/p>\r\n\r\n\r\n\r\n

    The first small deposits may be left untouched because buyers often start by testing the wallet: they send a small amount, transfer it back, and move their main savings only after confirming that everything works. In the counterfeit Trezor Model T case investigated by Kaspersky, the attackers stole the funds a month after the first deposit.<\/p>\r\n\r\n\r\n\r\n

    Other scammers automate withdrawals and take the funds soon after they arrive. You cannot infer their intentions from what happens to the first few transfers: a successful test transaction does not prove that you are the only person with access to the wallet<\/strong>.<\/p>\r\n\r\n\r\n\r\n

    Documented cases of hardware wallet tampering<\/h2>\r\n\r\n\r\n\r\n

    Scammers may tamper with the recovery card, the device itself, or the app used to set it up, as the following cases show.<\/p>\r\n\r\n\r\n\r\n

    A loss of 50 million yuan after buying a wallet through Douyin<\/h3>\r\n\r\n\r\n\r\n

    In June 2025, SlowMist reported a case involving a buyer<\/a> who lost crypto assets worth approximately 50 million yuan<\/strong> after purchasing a hardware wallet through the Chinese platform Douyin.<\/p>\r\n\r\n\r\n\r\n

    A counterfeit Trezor Model T with 20 preset phrases<\/h3>\r\n\r\n\r\n\r\n

    In 2023, Kaspersky published an analysis of a counterfeit Model T<\/a> bought through a classified ads website. Trezor clarified that the incident itself had occurred more than a year before publication. The device had the familiar interface but used a different microcontroller and modified firmware that selected one of 20 preset phrases when creating a wallet.<\/p>\r\n\r\n\r\n\r\n

    If the owner added a passphrase, the modified firmware used only its first character. That left 64 possibilities, including no passphrase at all, so the attackers only needed to check 20 \u00d7 64 = 1,280 combinations<\/strong>. Trezor confirmed that the device had been modified and noted that the seller was not authorized by the manufacturer.<\/p>\r\n\r\n\r\n\r\n

    Tampered Ledger devices mailed to customers after a data breach<\/h3>\r\n\r\n\r\n\r\n

    A Ledger customer data breach in 2020<\/a> exposed more than a million email addresses, along with contact details for some buyers, including shipping addresses. The database did not contain seed phrases.<\/strong> In 2021, users reported receiving Nano X devices they had not ordered. These arrived in sealed packaging with a letter supposedly from Ledger CEO Pascal Gauthier, offering a \u201cnew secure device\u201d following the breach.<\/p>\r\n\r\n\r\n\r\n

    A USB storage component containing malicious software had been soldered inside the tampered wallet. The instructions asked the recipient to enter their existing 24-word phrase into an app to \u201cmigrate\u201d the wallet, sending the words to the scammers. Ledger describes this attack<\/a> and warns against connecting devices you did not order.<\/p>\r\n\r\n\r\n\r\n

    A counterfeit Nano S Plus supplied with a malicious app<\/h3>\r\n\r\n\r\n\r\n

    In April 2026, a researcher in Brazil published an analysis of a counterfeit Ledger Nano S Plus<\/a> purchased from a Chinese marketplace. Inside, the researcher found an ESP32-S3 microcontroller with its markings erased, along with seed phrases and PINs stored in plaintext in the device\u2019s memory. The seller also supplied a modified app called Ledger Live that sent data to the attackers.<\/p>\r\n\r\n\r\n\r\n

    The researcher clarified that this counterfeit cannot pass Genuine Check in the official Ledger app<\/strong>; the success message in the malicious app was hardcoded. A QR code included in the package directed the buyer to a cloned website to install that fake app.<\/p>\r\n\r\n\r\n\r\n

    Other ways scammers get you to use their phrase or reveal yours<\/h2>\r\n\r\n\r\n
    \r\n
    \"A<\/figure>\r\n<\/div>\r\n\r\n\r\n

    Scams do not always involve a card with printed words. Other schemes ask buyers to use a wallet that has already been set up, install a fake app, or disclose their own phrase under the pretext of verification:<\/p>\r\n\r\n\r\n\r\n