Crypto analyst Steph Is Crypto has warned XRP holders to take a closer look at their hardware wallets after reports of a major theft involving Ledger devices. The warning centers on a simple but serious issue: a hardware wallet should never arrive with a recovery phrase already written out.
“XRP HOLDERS, CHECK YOUR HARDWARE WALLETS!” Steph Is Crypto wrote. The analyst cited a warning from a former Goldman Sachs analyst, who said a wallet that arrives with a pre-filled seed phrase could already have a security problem.
The warning comes as reports put losses linked to a recent Ledger-related incident at close to $90 million. However, the post referred to more than $90 billion in stolen funds. Available reports do not support that larger figure, with reported losses instead sitting around the $86 million to $90 million range.
A Pre-Filled Recovery Phrase Can Put Funds at Risk
A recovery phrase controls access to the crypto accounts created from it. For that reason, users should generate their own phrase when they first set up a hardware wallet.
A legitimate device generates the recovery phrase during setup. The user then writes the words down and keeps them somewhere secure. The manufacturer should not send the phrase inside the box, and users should never accept a phrase that someone has already written down for them.
A scammer can exploit this process by preparing a wallet before it reaches the buyer. The attacker already knows the recovery phrase and can therefore monitor the wallet. If the buyer follows the instructions and deposits XRP or another cryptocurrency into the wallet, the attacker could use the same phrase to access the funds.
That makes a pre-filled recovery card one of the clearest warning signs users should not ignore.
Reports Link the Losses to a Distribution Channel
The warning follows reports of a suspected supply-chain compromise involving Ledger devices sold through CryptoBilis, a Southeast Asian reseller. Reports have placed the losses at more than $86 million, with estimates later approaching $90 million.
The reported figure differs sharply from the $90 billion amount mentioned in Steph Is Crypto’s warning. The larger number appears to have overstated the reported losses by a substantial margin.
The incident also does not mean that every Ledger device has been compromised. Reports have focused on the specific distribution channel involved while investigations continue into how the affected devices reached customers.
Steph Is Crypto’s warning ultimately centers on a straightforward security check: a hardware wallet should generate its recovery phrase for the user during setup, not arrive with one already prepared.
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
