Cryptocurrency analyst Steph Is Crypto has urged XRP owners to thoroughly inspect their hardware wallets following news of a significant theft tied to Ledger devices. The alert focuses on a fundamental security rule: a hardware wallet must never be delivered with a recovery phrase already provided.
“XRP HOLDERS, CHECK YOUR HARDWARE WALLETS!” stated Steph Is Crypto. The analyst referenced an advisory from a former Goldman Sachs analyst, pointing out that a device arriving with a pre-written seed phrase signals a major security flaw.
This advisory emerges alongside reports estimating losses from a recent Ledger-related security breach at nearly $90 million. While the analyst’s post mentioned more than $90 billion in stolen assets, actual reports indicate that losses are actually between $86 million and $90 million, leaving the larger figure unsupported.
A Pre-Filled Recovery Phrase Can Put Funds at Risk
Because a recovery phrase governs access to all crypto accounts derived from it, users must generate their own phrase during the initial setup of a hardware wallet.
Genuine hardware devices generate this recovery sequence during the setup process. The owner is then responsible for recording the words and storing them securely. Manufacturers never ship the seed phrase inside the packaging, and individuals should always reject devices where a recovery phrase has been filled out in advance.
Bad actors manipulate this workflow by tampering with a wallet prior to delivery. Because the attacker retains a copy of the recovery phrase, they can track the wallet’s activity. Once an unsuspecting buyer deposits XRP or other digital assets into the compromised device, the attacker can use the known phrase to steal the funds.
Consequently, receiving a hardware wallet with a pre-filled recovery card is a critical red flag that must not be overlooked.
Reports Link the Losses to a Distribution Channel
This advisory stems from reports of a suspected supply-chain security breach affecting Ledger hardware sold via CryptoBilis, a reseller operating in Southeast Asia. Current reports estimate total losses starting above $86 million and climbing closer to $90 million.
These documented figures contrast significantly with the $90 billion claim cited in the warning by Steph Is Crypto, which appears to have vastly exaggerated the actual financial impact.
This situation does not imply that all Ledger wallets are unsafe; ongoing investigations indicate that the issue is isolated to a specific supply channel and how those particular units reached buyers.
Ultimately, the core message from Steph Is Crypto is a vital security precaution: a hardware wallet should always generate its own recovery phrase during initial setup rather than shipping with one already filled out.