tampered.app
English

Has your hardware wallet been tampered with?

Open the device, photograph its circuit board, and we’ll look for parts that shouldn’t be there: extra chips, wires, antennas and signs of re-soldering.

Not sure you should open it? Read this first.

Yishi Wang

Yishi Wang · Founder of OneKey

Since the implant news broke, owners of every brand have been asking me how to tell whether their wallet was tampered with. So I built this. Every device goes through the same rules, OneKey’s included.

Board check

1Your device

Pick a brand to see its models.

2Photos of the opened board

Photograph the whole board with the chip markings in focus.

Pick your model to continue.

Finds
Added boards and modules, antennas, fine wires, re-soldering, and chips that don’t match your model.
Can’t see
Firmware, the inside of chips, and anything hidden under shields, the screen or the battery.
Privacy
Free and anonymous. Photos are checked in memory and never stored. Location data is removed on your device before upload.

Should you open your device?

Opening a hardware wallet can void the warranty, and a careless opening can damage it. Whether it’s worth it depends on where the device came from.

  1. You bought it from the manufacturer’s own store

    Run the official check and set the device up yourself. Opening it is optional.

  2. You bought it from a reseller, an online marketplace or second-hand

    Open it and check the board, or replace it with one bought directly from the manufacturer.

  3. You have already lost funds

    Don’t open it yet. Contact the manufacturer and the police first, so the device can be examined as evidence.

If you open it

  • Back up your recovery phrase first, and make sure you can restore from it.
  • Use plastic pry tools, not metal. Some cases are glued or welded and won’t close cleanly again.
  • If the device has a battery, never bend, puncture or pry against it.
  • Never photograph or type your recovery phrase. This site will never ask for it.

What to look for

The implants found in 2026 read the recovery phrase off the screen and send it out over a cellular connection. That needs a modem, an antenna and power, and each of them leaves a trace.

An extra board or module

Anywhere in the case, including under the screen and on top of the battery. A metal-shielded module printed with FCC, CE or CMIIT marks is a radio module, and no hardware wallet contains a cellular one.

An antenna that doesn’t belong

A thin wire running along the edge of the case, a coil of copper wire, or a tiny round coax connector.

Fine wires

Hair-thin copper wires soldered between points on the board, often near the screen connector or the USB port.

Signs someone was there first

A torn foam pad or leftover glue behind the screen, chips with their markings scratched off, a battery that looks smaller or unlabelled, or a case held shut with glue or tape.

Taking good photos

  1. Use daylight or a bright lamp, and turn the flash off so the chips don’t glare.
  2. Hold the phone straight above the board and let the board fill the frame.
  3. Tap the largest chip to focus. Zoom in afterwards: you should be able to read its markings.
  4. Photograph both sides of the board, and underneath the screen if it lifts without force.

Why one check isn’t enough

Each check sees something the other two can’t. A tampered device can pass any one of them.

1

Official check

In the manufacturer’s app

Shows

The security chip is genuine and carries the manufacturer’s key.

Misses

Hardware added next to the genuine chips. An implanted device can still pass.

2

Look inside

On this site

Shows

Nothing visible has been added, rewired or re-soldered.

Misses

Firmware, the inside of chips, and anything the camera can’t see.

3

Where it came from

Your receipt and the box

Shows

It came from the manufacturer or an authorised reseller, and you created the recovery phrase yourself.

Misses

Nothing on its own, but most tampered devices are sold through unofficial or compromised sellers.

If any of the three fails, stop using the device. Set up a new wallet with a new recovery phrase on a device bought directly from the manufacturer, and move your funds to it.

Guides by brand

Known cases

None of these devices came straight from the manufacturer’s own store.

  1. Ledger confirms an implant in a device sold by a reseller

    Ledger confirmed that a device sold by CryptoBilis, a Malaysia-based reseller, contained an unauthorised hardware implant. According to Ledger, it reads the 24 recovery words off the screen during setup and sends them out over a cellular connection with an eSIM, without touching the secure chip. Ledger, OneKey and Trezor all cut ties with the reseller, and MediaMarktSaturn paused Ledger sales in Europe after a separate customer report.

    BleepingComputerDecryptThe Block

  2. Three generations of Nano X implants, each harder to spot

    Researchers documented implants that went from a green add-on board with a hand-wound copper antenna and enamelled wires, to a flex circuit laminated across the board, to a black-painted flex hidden behind the screen whose only visible sign is a thin antenna wire along the top edge.

    Tibane LabsJoe Grand

  3. Counterfeit Nano S Plus from an online marketplace

    A fake built around an ESP32-S3 chip with its markings scraped off, plus a wireless antenna that a genuine Nano S Plus doesn’t have, sold with a trojanised app. It failed Ledger’s real Genuine Check.

    Cybersecurity NewsThe Crypto Times

  4. Counterfeit Trezor Model T

    Kaspersky examined a fake Model T whose main chip had been swapped for a different part, with solder marks around it, and whose case was held shut with glue and double-sided tape instead of an ultrasonic weld. Its holograms were intact.

    Kaspersky

  5. Fake “replacement” Nano X sent by post

    Criminals mailed altered Nano X devices to Ledger customers, with a small USB flash drive soldered to the USB connector by four wires.

    BleepingComputer

Questions

Can a photo really find a backdoor?

It can find a hardware one. An implant needs space, power and connections, and those leave visible traces: an extra chip, wires, an antenna, fresh solder or glue. A photo can’t find a firmware backdoor, or a fake chip that looks exactly like the real one. That’s what the official check and buying from official channels are for.

My device is new and sealed. Should I open it?

Not necessarily. If it came from the manufacturer’s own store, run the official check and set it up yourself. Opening matters most for devices bought from resellers, marketplaces or second-hand, or from a seller named in an incident.

Is it safe to upload photos of my wallet?

A photo of the board contains no keys and no recovery phrase. Location data is removed on your device before upload, and the photos are checked in memory and never stored. Never photograph your recovery phrase, here or anywhere else.

Who runs this site, and why trust it?

tampered.app is built by OneKey, which also makes hardware wallets. After a reseller was found selling implanted devices, owners of every brand asked us how to check theirs. The site applies the same rules to every brand, including ours, and never recommends a product. The About page explains how it works.

Which AI does the check, and can it be wrong?

An open-weight vision model running on Cloudflare Workers AI. It can be wrong both ways: it can miss a well-hidden implant, and it can flag something harmless. That’s why the model only describes what it sees, fixed rules decide the result, and a clean result is never called safe.

The check found something. What now?

Stop using the device and don’t enter a recovery phrase into it. If it holds funds, set up a new wallet with a new recovery phrase on a device bought directly from the manufacturer, and move the funds there. Keep the old device and send the photos to the manufacturer’s support team.