Has your hardware wallet been tampered with?
Open the device, photograph its circuit board, and we’ll look for parts that shouldn’t be there: extra chips, wires, antennas and signs of re-soldering.
- Free
- No sign-up
- Results in under a minute
Yishi Wang · Founder of OneKey
Since the implant news broke, owners of every brand have been asking me how to tell whether their wallet was tampered with. So I built this. Every device goes through the same rules, OneKey’s included.
Not sure you should open it? Read this first.
- Finds
- Added boards and modules, antennas, fine wires, re-soldering, and chips that don’t match your model.
- Can’t see
- Firmware, the inside of chips, and anything hidden under shields, the screen or the battery.
- Privacy
- Free and anonymous. Location data is removed on your device before upload.
Board check
Online-
Your device
Pick a brand to see its models.
-
Photos of the opened board
Photograph the whole board with the chip markings in focus.
Add a close-up of the main chips as a second photo. The check needs to read their part numbers.
-
Usually 10 to 30 seconds.
Looking for:
Should you open your device?
Opening a hardware wallet can void the warranty, and a careless opening can damage it. Whether it’s worth it depends on where the device came from.
You bought it from the manufacturer’s own store
Run the official check and set the device up yourself. Opening it is optional.
You bought it from a reseller, an online marketplace or second-hand
Open it and check the board, or replace it with one bought directly from the manufacturer.
You have already lost funds
Don’t open it yet. Contact the manufacturer and the police first, so the device can be examined as evidence.
If you open it
- Back up your recovery phrase first, and make sure you can restore from it.
- Use plastic pry tools, not metal. Some cases are glued or welded and won’t close cleanly again.
- If the device has a battery, never bend, puncture or pry against it.
- Never photograph or type your recovery phrase. This site will never ask for it.
What to look for
The implants found in 2026 read the recovery phrase off the screen and send it out over a cellular connection. That needs a modem, an antenna and power, and each of them leaves a trace.
01
An extra board or module
Anywhere in the case, including under the screen and on top of the battery. A metal-shielded module printed with FCC, CE or CMIIT marks is a radio module, and no hardware wallet contains a cellular one.
02
An antenna that doesn’t belong
A thin wire running along the edge of the case, a coil of copper wire, or a tiny round coax connector.
03
Fine wires
Hair-thin copper wires soldered between points on the board, often near the screen connector or the USB port.
04
Signs someone was there first
A torn foam pad or leftover glue behind the screen, chips with their markings scratched off, a battery that looks smaller or unlabelled, or a case held shut with glue or tape.
Taking good photos
- Use daylight or a bright lamp, and turn the flash off so the chips don’t glare.
- Hold the phone straight above the board and let the board fill the frame.
- Tap the largest chip to focus. Zoom in afterwards: you should be able to read its markings.
- Photograph both sides of the board, and underneath the screen if it lifts without force.
Why one check isn’t enough
Each check sees something the other two can’t. A tampered device can pass any one of them.
1
Official check
In the manufacturer’s app
Shows
The security chip is genuine and carries the manufacturer’s key.
Misses
Hardware added next to the genuine chips. An implanted device can still pass.
2
Look inside
On this site
Shows
Nothing visible has been added, rewired or re-soldered.
Misses
Firmware, the inside of chips, and anything the camera can’t see.
3
Where it came from
Your receipt and the box
Shows
It came from the manufacturer or an authorised reseller, and you created the recovery phrase yourself.
Misses
Nothing on its own, but most tampered devices are sold through unofficial or compromised sellers.
If any of the three fails, stop using the device. Set up a new wallet with a new recovery phrase on a device bought directly from the manufacturer, and move your funds to it.
Guides by brand
- OneKeyPro · Classic 1S · Classic 1S Pure · Pro 2 · Touch · MiniThe OneKey App’s Genuine check and firmware verification, the chips on each board, and the CryptoBilis replacement programme.
- LedgerNano X · Nano S Plus · Flex · Stax · Nano Gen5 · Nano SGenuine Check, the chips on each Ledger board, and where the 2026 implants were hidden.
- TrezorSafe 3 · Safe 5 · Safe 7 · Model One · Model TTrezor Suite’s authenticity check, Trezor’s open-source board files, and what a swapped chip looks like.
Known cases
None of these devices came straight from the manufacturer’s own store.
-
Ledger confirms an implant in a device sold by a reseller
Ledger confirmed that a device sold by CryptoBilis, a Malaysia-based reseller, contained an unauthorised hardware implant. According to Ledger, it reads the 24 recovery words off the screen during setup and sends them out over a cellular connection with an eSIM, without touching the secure chip. Ledger, OneKey and Trezor all cut ties with the reseller, and MediaMarktSaturn paused Ledger sales in Europe after a separate customer report.
-
Three generations of Nano X implants, each harder to spot
Researchers documented implants that went from a green add-on board with a hand-wound copper antenna and enamelled wires, to a flex circuit laminated across the board, to a black-painted flex hidden behind the screen whose only visible sign is a thin antenna wire along the top edge.
-
Counterfeit Nano S Plus from an online marketplace
A fake built around an ESP32-S3 chip with its markings scraped off, plus a wireless antenna that a genuine Nano S Plus doesn’t have, sold with a trojanised app. It failed Ledger’s real Genuine Check.
-
Counterfeit Trezor Model T
Kaspersky examined a fake Model T whose main chip had been swapped for a different part, with solder marks around it, and whose case was held shut with glue and double-sided tape instead of an ultrasonic weld. Its holograms were intact.
-
Fake “replacement” Nano X sent by post
Criminals mailed altered Nano X devices to Ledger customers, with a small USB flash drive soldered to the USB connector by four wires.
Questions
Can a photo really find a backdoor?
It can find a hardware one. An implant needs space, power and connections, and those leave visible traces: an extra chip, wires, an antenna, fresh solder or glue. A photo can’t find a firmware backdoor, or a fake chip that looks exactly like the real one. That’s what the official check and buying from official channels are for.
My device is new and sealed. Should I open it?
Not necessarily. If it came from the manufacturer’s own store, run the official check and set it up yourself. Opening matters most for devices bought from resellers, marketplaces or second-hand, or from a seller named in an incident.
Is it safe to upload photos of my wallet?
A photo of the board contains no keys and no recovery phrase. Location data is removed on your device before upload. Never photograph your recovery phrase, here or anywhere else.
Who runs this site, and why trust it?
tampered.app is built by OneKey, which also makes hardware wallets. After a reseller was found selling implanted devices, owners of every brand asked us how to check theirs. The site applies the same rules to every brand, including ours, and never recommends a product. The About page explains how it works.
Which AI does the check, and can it be wrong?
Anthropic’s Claude, a vision model called through Cloudflare. It only reads the chip markings and lists what is on the board; fixed rules decide the result: the main chips must be original parts whose part numbers match your model, and nothing may be added. It can still be wrong, which is why a clean result is never called safe.
The check found something. What now?
Stop using the device and don’t enter a recovery phrase into it. If it holds funds, set up a new wallet with a new recovery phrase on a device bought directly from the manufacturer, and move the funds there. Keep the old device and send the photos to the manufacturer’s support team.