PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Before the first signature: reviewing trust in security hardware
Buying a security device should remain verifiable after delivery. An original assessment of inventory, vendors, custody and responses to suspected tampering.
By Pentesty
The verified starting point
Cyber Security Brazil linked the case to devices sold through CryptoBilis. In its October 15 statement, Ledger said hidden components were added during distribution to capture recovery phrases during setup. The company said its chip, operating system and servers were not compromised. The referenced technical X post could not be accessed during this review; we do not reproduce transmission details or loss estimates.
Four decisions before the device enters service
First, decide who can approve its origin. A commercial vendor listing does not, on its own, account for distributor changes, returns or replacements. Our proposal is to connect the purchase order, seller, delivery and receiving owner in a retrievable record. An exception needs a reason and an identifiable approval before activation.
Second, establish who can change the equipment between receipt and use. Imagine a legitimate batch temporarily stored in a shared area. Without alleging fraud by anyone, there is a gap if the business cannot determine who removed a unit. The control should produce a custody history, with clear boundaries for storage and movement.
Third, identify which checks each team can actually perform. Software validation answers the conditions it examines. Inventory records identify the assets present. Neither record, by itself, describes the device's complete physical history. Our guide to connected devices at work helps map those boundaries and the people responsible for them.
Fourth, decide who can authorize the first sensitive operation. Separate purchasing, acceptance and use where the impact justifies it. The business needs a documented decision, sufficient evidence, an accountable owner and a way to suspend the process. The same discipline appears in our security vendor evidence checklist. A purchase decision should leave something another team can verify.
A receiving exercise that produces evidence
- Reconcile a sample: Choose equipment without production data. Compare the order, supplier, delivery and internal record. Document who resolves a mismatch and prevent activation until a decision is recorded. Evidence: a reconciled sample, exceptions and dated approvals.
- Test stock removal: Simulate a request outside the approved process. Check whether a unit can leave without a record and whether the team can identify the decision owner. The simulation must be authorized. Evidence: the withdrawal sequence and observed response.
- Define how returns are handled: Ask purchasing and operations to explain how they distinguish new, returned and replacement items. Record the applicable manufacturer rules and where rejected units go, without mixing them back into approved stock. Evidence: a procedure and traceability for the test unit.
- Rehearse a suspicion: Use a fictional alert to test who suspends use, preserves context and contacts official support. Do not turn the exercise into an improvised teardown of an actual device or destroy evidence before specialist guidance. Evidence: named owners, timestamps and recorded decisions.
The investigation needs boundaries too
A suspect unit may contain material relevant to an investigation. Agree in advance on who directs preservation and any specialist examination. Our article on insider threats and sensitive environments connects physical access, ownership and records. These scenarios are editorial proposals, not results of testing Ledger products. Treat unanswered questions as open assessment items rather than silently marking them complete.
Frequently asked questions
Does intact packaging prove provenance?
It is an observation to record, but it does not replace purchase, transport and custody history. Define the evidence required to accept each category of equipment.
Is every Ledger device compromised?
The reviewed reporting does not support that generalization. The company describes a distribution incident; decisions about particular units should follow current official information.
Can a web pentest detect physical implants?
Application testing examines agreed assets and controls. Laboratory hardware evaluation and tampering investigations require their own expertise and explicitly commissioned scope, with separate coverage and deliverables.
What is a useful first deliverable for a business?
A custody map with accountable owners and verifiable exceptions. It helps locate process gaps and choose which controls or specialist assessments should receive priority.
Sources and references
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.