A Ledger hardware wallet, the device people buy so that nobody else ever sees their crypto keys, has been found with an extra circuit board hidden inside. Ledger confirmed that the device of one user caught up in a wave of thefts in Southeast Asia contained an “unauthorized hardware implant,” and it has told customers of the reseller CryptoBilis not to switch on wallets they have not yet set up.

The problem reaches beyond one shop. A hardware wallet’s whole promise is that the secret recovery phrase is created and shown only on its own small screen, never on a phone or laptop that malware can reach. If someone can open the box before it reaches the buyer and wire a spy into that screen, the secure chip inside…