Compromised Hardware Wallet: Response Plan

A hardware wallet that arrives looking fine can still be dangerous. Intact packaging, a clean seal, and a printed serial number are not proof that the device inside is safe to fund.

Tangem's official app is one concrete example of the verification process. This guide walks through what verification can actually establish, a concrete checklist to run before you transfer any assets, the warning signals that mean you should stop immediately, and what to do when a check fails.

What Verification Can Establish

A hardware wallet is a physical device that generates and stores private keys offline, signs transactions internally, and returns only the signed transaction to its companion app. The keys never travel across the internet.

Verification covers three separate things, and it helps to keep them distinct.

• Product authenticity answers whether the device you received was manufactured by the company it claims to be from. Most manufacturers provide a cryptographic check through their official app: the app queries the chip, the chip responds with a signed certificate, and the app confirms the signature. If the chip is counterfeit, that check fails. Packaging condition is one signal, but it is not the check itself.

   

• Setup integrity answers whether a new private key was generated during your setup session, on your device, under your control. If a new wallet asks you to enter a 12- or 24-word phrase that came with the box, stop. A device that passes the authenticity check can still be compromised if someone else already generated a key on it before it reached you. The app's prompt to "create a wallet" is meaningful precisely because it indicates the chip does not yet contain a private key.

   

• Ongoing security is everything that happens after setup. It depends on how you protect your access credentials, where you store backup material, and whether you review transactions before signing. Passing an authenticity check does not make a user safe from phishing, lost recovery material, or approving a harmful transaction.

That distinction matters. Verification of a device does not remove the user-side risks of phishing, lost keys, unsafe backups, or signing a harmful transaction: self-custody shifts responsibility for those risks to the holder.

A Step-by-Step Verification Checklist

Run these checks before you transfer any meaningful amount to a new device. The order matters.

1. Confirm the purchase source. Buy directly from the manufacturer's official website or a listed authorized reseller. Instructions supplied by an unknown third-party seller should not replace the manufacturer's official setup guide.

    

2. Inspect packaging against official product images. Look for resealed seams, broken tamper-evident stickers, irregular printing, or mismatched fonts. Compare what you see against the manufacturer's official product images. Discrepancies are worth investigating, but intact packaging alone does not clear the device.

    

3. Run the manufacturer's authenticity check before setup. For most hardware wallets, this means opening the official companion app and following its verification flow before you create a wallet or import any keys. The app checks whether the chip was produced by the manufacturer and carries the expected firmware.

    

4. Confirm the device prompts you to create a new wallet. A device that arrives already initialized, or that asks you to enter a phrase someone else provided, is a serious warning sign. The correct state for a new device is blank: it should ask you to begin setup, not to continue one.

    

5. Generate your own recovery material during setup. If your wallet model uses a recovery phrase, that phrase must be generated by the device during your setup session. A 12- or 24-word phrase is the master backup: anyone who has it can control the associated funds. Never use a phrase that arrived in the box or was sent to you by a seller.

    

6. Test with a small amount first. Before committing substantial value, move a small amount, complete a full send-and-receive cycle, and confirm the process works as expected. This is standard practice regardless of the device.

    

7. Store backup material securely and separately. Never store a private key or recovery phrase in cloud storage, phone photos, or any internet-connected location. Keep physically separate backups and test recovery before storing large amounts.

This checklist covers the verification layer. It does not replace reading the manufacturer's official setup documentation, which will have model-specific steps.

Red Flags That Mean Stop

Some signals are unambiguous. If you encounter any of the following, stop setup and do not fund the device.

• A pre-written recovery phrase in the box is the clearest red flag. The documented counterfeit-wallet attack relies on an attacker supplying a phrase they already know, rather than letting the device generate one during setup. If a phrase is printed on a card, written in the manual, or included as a separate slip, that is not normal. A 12- or 24-word phrase on that card gives its preparer control of the associated funds. No legitimate hardware wallet ships with a recovery phrase already written out.

   

• A device that appears already initialized before you begin setup is a stop signal. The correct state for a new device is blank.

   

• Requests for your seed phrase or private key from any source, including a support agent, an app update prompt, or a migration tool, are phishing. No legitimate support team, app, or wallet tool ever needs that information.

   

• Resealed or irregular packaging combined with mismatched product details should prompt a direct comparison against the manufacturer's official verification process, not an assumption that the device is safe. Packaging can be carefully repacked while internal hardware remains modified.

   

• Instructions that differ from the manufacturer's official guide are worth questioning. If the seller included a setup card with steps that don't match what the manufacturer's website says, follow the official version and treat the alternate instructions as suspect.

If a Check Fails

Stay calm. A failed check on an unfunded device means you have caught a potential problem before it became a financial loss.

1. If you find a 12- or 24-word phrase in the box, leave the device unfunded.

    

2. Do not fund the device. Do not enter a seed phrase or attempt to move assets into a device whose integrity is uncertain.

    

3. Contact the manufacturer through an official support channel, not a link in the box or a number provided by the seller. Report the issue with your order details, photos of the device and packaging, and the specific check that failed. Manufacturers can investigate whether the device is counterfeit or defective and advise on the return and replacement process.

    

4. Keep all evidence: the original packaging, photos, order confirmation, and a written note of what the verification step showed. This documentation supports any claim with the manufacturer or the selling platform.

A hardware wallet protects keys from many online attack paths. But it does not make a user safe from phishing, malware, lost recovery material, or unsafe signing decisions. Catching a problem at the verification stage is the best possible outcome.

How Tangem's Design Reduces Specific Attack Vectors

Tangem Cold Wallet addresses several of the risks described above through specific design choices. Understanding which vectors those choices reduce, and which risks remain, is more useful than a blanket security claim.

The card uses a Samsung S3D350A secure element certified at Common Criteria EAL6+, the same certification level used in biometric passports and international payment cards. Private keys are generated on-chip by a DRAM-based true random number generator, stored exclusively in the secure element, and cannot be extracted or duplicated. All cryptographic signing happens on-chip.

Tangem's default setup is seedless: keys are generated on the card and no recovery phrase is created or stored. This removes the recovery-phrase exposure path entirely in the default configuration. A seed phrase remains optional for users who want one, but the default removes the attack vector where an attacker supplies a pre-written phrase.

The card has no battery, no USB port, no Bluetooth radio, and no screen. Connectivity is NFC only, with a required tap within 0-5 cm. Firmware is factory-installed and non-updatable, which eliminates remote-exploit vectors that rely on malicious firmware updates.

The Tangem app performs a cryptographic authenticity check before any operation. Tangem's official guidance states the app verifies whether the card was produced by Tangem and carries the expected firmware. A prompt to create a wallet indicates the card does not already contain a private key. The app code is open-source on GitHub, and Tangem lists independent firmware audits by Kudelski Security, Riscure, and Cure53.

Here's what remains: Tangem's design does not protect against phishing, malicious transaction approvals, user error, or physical loss. If all cards in a set are lost and no seed phrase exists, the funds are permanently inaccessible. No wallet design makes self-custody risk-free; it redistributes where the risk sits.