Score one for the safety-minded and cryptographic hardware checks. Joje Mendes, a Brazilian cybersecurity professional, almost got bitten by a sophisticated hardware-and-software phishing attack, in the form of a fake Ledger Nano S+ cryptocurrency wallet. The only barrier between Past’s virtual currency and the device’s remote operators was Ledger’s software, which verified that it was running on legitimate hardware.

The story starts when Mendes decided to order the Ledger device from a “major marketplace” in China. He chose to do so because, being a non-Chinese citizen currently located in Shenzhen, importing one from abroad, directly from Ledger, “comes with its own…