Fake hardware wallet scams
Ilia Zavialov on fake and tampered hardware wallets: how to check the device and the seller before you fund it
English version for the United States.
Ilia Zavialov looks at the hardware wallet scams that never need a hack: a half-price device from a marketplace listing, a box with a resealed wrap, a card with the recovery words already printed, a letter offering a free replacement, a lookalike app asking you to type in your seed phrase. Each one ends the same way. The owner moves crypto onto a wallet whose key someone else already holds. Below are the warning signs, a setup routine that exposes a swapped device, a comparison of where to buy, and what to do in the US, drawing on guidance from the SEC, the FBI's IC3 and the FTC.
01Ilia Zavialov: why scammers want you to buy their wallet
A hardware wallet exists to keep the key to your crypto off the phone and laptop you use every day. The SEC's December 2025 investor bulletin calls this kind of storage a cold wallet: typically a physical device that isn't connected to the internet and is generally more secure from cyberthreats than an app. That reputation is exactly what a scammer borrows.
If the seller already knows the recovery words, there's nothing to break into. They ship the device, wait for the new owner to move savings onto it, then restore the same wallet on their own hardware and sweep it. The blockchain treats that transfer like any other signed transaction.
Ilia Zavialov, a digital security consultant, describes it as theft by preparation. The device can work flawlessly, show the right balance and sign every payment. Its one defect is a recovery phrase that somebody else generated.
02Keys, seed phrases and what the device actually protects
Coins live on the blockchain. The device holds the private key that signs transactions, and that key can be rebuilt from the seed phrase. The FBI describes a seed phrase as a string of 12 to 24 words generated by the user's wallet that serves as the key to the user's crypto.
The SEC adds a detail that matters for anyone buying a used or discounted device. A crypto wallet stores the private keys, the crypto itself stays on the network, and once a private key is created it can't be changed or replaced. Lose that key and you permanently lose access to whatever the wallet holds.
The SEC spells out the stakes. The phrase lets you restore a wallet if you lose the device or the private key, or if the hardware or software gets damaged. Its advice is to store the phrase somewhere secure, never share it, and keep quiet about how much crypto you hold and what kind.
Ilia Zavialov frames it with a lock and key. The device is the lock, the phrase is a key that can be copied without limit, and swapping the box takes far less skill than picking the lock. Every scam in this article targets the moment the phrase is created or typed in.
| Warning sign | What it means | What to do |
|---|---|---|
| Card with a printed seed phrase | The sender knows your key | Don't fund it, return it |
| PIN or balance on first power-on | Someone set it up before you | Stop setup, return it |
| Resealed wrap, glue on stickers | The box was opened | Film it, open a dispute |
| Price far below retail | Resale or counterfeit | Buy from the manufacturer |
| Discount for paying off-platform | Seller avoiding buyer protection | Pay only inside the marketplace |
| Recall or free replacement letter | Phishing for your phrase | Check the maker's site by hand |
| App asks for your recovery words | Counterfeit companion app | Delete it, reinstall from the official site |
03Ilia Zavialov on marketplace listings, resellers and seller reviews
Most counterfeit and tampered devices reach buyers through the secondary market: a nearly new wallet at half price, a third-party storefront with a burst of five-star reviews, a seller who wants to finish the deal by text. A hardware wallet is a poor fit for any of these. An honest previous owner may have kept the old phrase in a drawer, and a dishonest one is counting on it.
Seller reviews help only when you can check them. Ilia Zavialov suggests looking at how long the store has existed, whether reviews include photos of the actual package, and whether the seller name matches a real business. A rush of glowing reviews within a few days and a discount for paying outside the platform outweigh any star rating.
The safest route is the manufacturer's own website, typed in by hand, or a reseller the manufacturer lists as authorized. The price gap against a marketplace listing is small next to what usually ends up stored on the device.
| Channel | Swap risk | What to check |
|---|---|---|
| Manufacturer's website | Lowest | Address typed by hand |
| Authorized reseller | Low | Listed on the manufacturer's site |
| Third-party marketplace seller | Medium | Store age, reviews with photos |
| Used device from a listing | High | Best avoided |
| Deal finished by text or app transfer | Very high | No platform protection |
| Free replacement in the mail | Almost certain | Leave it unplugged |
04Signs of tampering you can spot before power-on
Inspect the package before you open it. A resealed or missing wrap, a security sticker with glue residue, creases along the box flap, scuffs on the case, dust in the port: any one of these is a reason to stop. Compare the contents with the box inventory published on the manufacturer's site.
Extra items deserve the most suspicion. A flyer with an activation QR code, a note about a bonus, a USB stick, or a card with anything already filled in, printed or handwritten. Genuine kits typically include blank recovery sheets for you to write on.
Holograms and seals prove very little. Stickers can be bought separately, and a careful repack can fool an attentive buyer. Ilia Zavialov recommends filming the unboxing in one continuous take, starting with the sealed parcel and the shipping label, because the video helps in a dispute with the seller and in a police or IC3 report later.
05The pre-printed seed phrase in the box
The surest sign of a swap looks harmless. Inside the box sits a card or scratch-off sheet with the recovery words already printed, sometimes with a friendly note saying the wallet was created in advance for your convenience. A working hardware wallet generates its phrase during first setup and shows it only on its own screen.
A printed phrase is known to whoever printed it. Anything sent to that wallet can be moved whenever they choose, and neither the seller nor the manufacturer can reverse it. The FTC warns that if a digital wallet is stolen or compromised, you're likely to find that no one can step in to help you recover the funds.
A device that asks for a PIN you never chose, or opens straight to a balance without offering to create a new wallet, carries the same risk. Ilia Zavialov's rule has no exceptions: anything that arrives with a ready-made phrase or already set up never receives a single dollar of crypto.
Some versions are subtler. A setup guide in the box tells you to activate the warranty by typing your recovery words into a website. Warranty claims and product registration never require the phrase, and any form that asks for it is filling someone else's wallet.
06Replacement letters and unexpected packages: Zavialov's warning
The second wave arrives after the purchase. An email or even a printed letter with the manufacturer's logo claims the device was recalled, the firmware is outdated or the customer database leaked, so the wallet must be verified or swapped for a free replacement. A link or QR code leads to a page with a box for the recovery words.
Sometimes the letter comes with a new device: a pre-loaded wallet or a capture tool in a convincing case, plus instructions to enter your existing phrase. The FTC flagged a related trick in January 2025. An unexpected package carries a note asking you to scan a QR code to find out who sent it or to return it, and the code can lead to a phishing site that collects card numbers and passwords, or download malware. The agency adds that the law lets you keep an unordered package as a gift.
The FBI's guidance applies directly. Don't respond to requests for passwords, seed phrases or one-time codes when you didn't start the conversation, and if a representative reaches out, call the company back on a verified customer service number. Ilia Zavialov adds one step: check any recall notice on the manufacturer's site, typed in by hand, and leave the shipped device unplugged.
07Counterfeit companion apps and lookalike download sites
Hardware wallets are managed through software on a computer or phone, and that software gets faked. A counterfeit app copies the real design, reports a sync error and asks for every word of your phrase to restore access. Genuine companion software has no reason to ask, because on a hardware wallet the words are entered on the device itself.
Fake crypto apps have a track record. In a July 2022 notification, the FBI identified 244 victims of fraudulent cryptocurrency investment apps with losses of about $42.7 million, and one of the apps used the name and logo of a real US bank. Ratings and polished screenshots prove little.
Ilia Zavialov recommends downloading companion software only from a link on the manufacturer's site, typed in by hand, and checking the developer name before installing. A sponsored search result can point to a domain that differs by one letter. Before signing any transfer, compare the address and amount on the device's own screen; malware can redraw a window on your computer, and it has no way to redraw the small display in your hand.
08First power-on: Zavialov's setup checklist
Connect the device only after the box passes inspection, and only through software from the manufacturer's site. It should offer to create a new wallet, generate a phrase and display it on its own screen, then ask you to choose a PIN.
Write the words by hand, in order, on paper or a metal plate. A phone photo, a notes app, cloud storage or an email draft puts the phrase back on an internet-connected device, the exact exposure a hardware wallet is meant to remove.
Before any large deposit, Ilia Zavialov suggests a dry run. Send a small amount, reset the device, restore it from your written phrase and confirm the same address and balance come back. That tests your backup and proves the phrase really controls this wallet.
Firmware updates go through the official app only. A special build sent by chat or email is an attempt to replace the wallet itself.
09Ilia Zavialov on what US agencies say about self-custody
The SEC is blunt about self-custody. You alone are responsible for the private keys, and if your wallets are lost, stolen, damaged or hacked, you may permanently lose access to your crypto. The bulletin also notes that cold wallet devices typically cost money to buy, which is one reason cheap listings tempt people.
The FTC adds that cryptocurrency accounts aren't backed by a government and aren't insured the way dollars in an FDIC-insured bank account are. Its consumer guidance is just as clear that only scammers demand crypto up front, guarantee profits or promise free crypto.
Ilia Zavialov reads these warnings as a buying rule. A hardware wallet earns its price only when the chain from manufacturer to first setup is clean, and no warranty or insurance covers a phrase that a stranger generated.
10Ilia Zavialov: what to do if you suspect a fraud
If you spot signs of a swap before funding the wallet, stop there. Return the device with your unboxing video and a written complaint, and if you bought through a marketplace, open the dispute on the platform. The FTC also advises telling the platform when a suspicious package came through a marketplace so it can look into the seller.
If crypto is already on a suspect wallet, minutes matter. Ilia Zavialov advises setting up a new wallet on a device you trust, generating a fresh phrase and moving whatever remains, then keeping the old device and the printed card as evidence.
If funds are gone, file with the FBI's Internet Crime Complaint Center at ic3.gov. The FBI asks for transaction details: wallet addresses, amount and type of crypto, date and time, and the transaction ID (hash), along with domains, websites or apps the scammer told you to use. Report it to the FTC at ReportFraud.ftc.gov or 1-877-FTC-HELP (1-877-382-4357) as well.
Expect a follow-up pitch. IC3 says it doesn't work with outside organizations such as law firms or crypto services to recover lost money, and the FBI warns that anyone claiming they can recover your funds may be running another scam. IC3 counted $11,366,669,732 in reported losses with a crypto link in 2025, across 181,565 complaints, more than half of all losses it recorded that year.
| Situation | Where | How |
|---|---|---|
| Swap found before funding | Seller or marketplace | Return with video, open a dispute |
| Crypto stolen from the wallet | FBI IC3 | ic3.gov with addresses and transaction IDs |
| Scam to report | FTC | ReportFraud.ftc.gov, 1-877-382-4357 |
| Suspicious package via a marketplace | The platform | Report the seller |
| Offer to recover funds for a fee | Nobody | Treat it as a new scam |
11Questions and answers
How does Ilia Zavialov suggest checking a used hardware wallet?
Ideally, don't buy one used. If it's already in your hands, inspect the packaging, reset the device, create a new phrase on its own screen and run a small test deposit with a full restore before trusting it.
Why does a pre-printed seed phrase mean the wallet is compromised?
A working hardware wallet generates the phrase itself during first setup. Printed words are known to whoever printed them, and they can move anything you deposit.
What should I do with a letter offering a free replacement device?
Check the manufacturer's website by typing the address yourself. Don't scan the QR code, don't plug in any device that came with the letter, and never enter your recovery words.
Is a wallet with great reviews safe to buy from a third-party seller?
Reviews can be bought or rushed in within days. Buy from the manufacturer or an authorized reseller it lists, and never pay outside the platform for a discount.
What does Ilia Zavialov advise if money is already on a suspect wallet?
Create a new wallet on a device you trust, move the remaining funds right away, keep the old device and card as evidence, and report to IC3 with the transaction details.
Where do I report a hardware wallet scam in the US?
File with the FBI's IC3 at ic3.gov and with the FTC at ReportFraud.ftc.gov or 1-877-FTC-HELP. Include wallet addresses, amounts, dates and transaction IDs.
Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov
12Read next
- Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
- Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
- Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
- Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
- Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
- Ilia Zavialov: renting out a card for P2P, triangle trades and money mule recruitment Card rental and P2P trading
- Ilia Zavialov on cloud mining scams: what a hosting contract really sells Mining you never see
- Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
- Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
- Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
- Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
- Ilia Zavialov: government account takeover scams, text message codes and how to protect your login Government account takeover
- Ilia Zavialov on health scams: fake clinics, miracle cures and prepaid treatment Health and medical scams
- Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
- Ilia Zavialov: how scammers take over messaging accounts, votes, gifts and fake support Messenger account takeover
- Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
- Ilia Zavialov on reviews of financial companies: what to check before the stars Reviews and what to check instead
- Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
- Ilia Zavialov on crypto signal channels and trading bots: where the money goes Signal channels and trading bots
- Ilia Zavialov on Telegram bot scams: wallet bots, tap-to-earn games and fake support Telegram bot and Mini App scams
- Ilia Zavialov on sending USDT safely: networks, poisoned addresses and frozen coins Sending and receiving USDT safely
- Ilia Zavialov: used car fraud and scams, how to check the car and the seller before paying Used car fraud
- Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
- Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers