The point
A seed phrase is the master key to a crypto wallet, written as 24 words. Whoever has seen those words owns every coin the wallet holds, and no bank, helpline or court can reverse a transfer made with them. Where you keep the phrase matters. So does who could have seen it before you ever wrote it down.
What is a seed phrase, and why does seeing it mean owning it?
A seed phrase is the list of words from which a wallet derives every private key it will ever use. The private key is what signs a transfer. Anyone who can recreate the key can sign, so anyone who holds the words can empty the wallet from any device on earth.
There is no account behind it, no password reset and no support desk that can freeze a transfer. Ledger, a hardware wallet maker, says the same thing in its own warnings: it will never call, message or ask for your 24-word recovery phrase.
The practical result is a strange kind of secret. It has to be written down, because the wallet cannot be rebuilt without it. Yet every extra pair of eyes, camera or piece of software that touches it is a new way to lose everything at once.
What happened with the Ledger devices sold by CryptoBilis?
On 10 October 2026, Ledger stated that one affected user's device contained an unauthorized hardware implant. CoinDesk reported the statement on 12 October 2026: "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant."
Ledger's update of 11 October added that every confirmed case tied to the draining incident of 9 October involves a device sold through CryptoBilis. That reseller operates in Indonesia, Malaysia and the Philippines. Ledger says its own systems and direct sales channels were not compromised. CryptoBilis suspended sales of its hardware wallet stock while the investigation runs.
The loss figure is an outside estimate. As reported by CoinDesk, on-chain researchers put the theft at $86 million to $93 million from more than 300 wallets across Bitcoin, Ethereum, Tron and other chains. Ledger has not confirmed an official loss.
Ledger's guidance to buyers from that reseller is short. Do not initialize an unused device. If one is already set up, move to a new seed on a device from Ledger.
Nobody has yet published how the component got there, and we will not guess at it.
Why is the box you opened part of the security?
We think the common view of self-custody has a hole in it, and this incident sits in the hole. The common view says a hardware wallet keeps your keys offline, so the keys are safe. That holds only if the device that made the phrase did nothing else with it.
A seed phrase is generated at setup. If the device was altered before it reached you, the phrase can be random and stored perfectly in a steel plate in a locker. It can still be known to someone else from the first minute.
Storage protects a phrase after it exists. The supply chain decides who saw it first.
Ledger itself says the incident "underscores why we continuously review and strengthen our distribution and anti-tamper processes", and that it is reviewing authorized reseller controls.
Buy from the maker
A device bought from the manufacturer's own store removes the reseller from the chain. In this case, Ledger says its direct sales channels were unaffected.
Never accept a pre-filled phrase
A device that arrives with words already written on a card, or already set up, has had its secret created by somebody else. Treat it as compromised and send it back.
Never type the phrase anywhere
No site, app, support agent or form needs your 24 words. Ledger's own warning is that scammers use incidents like this one to pose as support. Anyone asking is the attack.
What does one phrase cost in rupees?
Take a crypto sleeve of ₹40 lakh held in one wallet behind one phrase. If a single party has seen that phrase, the exposure is the full ₹40 lakh, because one set of words controls the entire balance.
Split the same ₹40 lakh across four wallets, each with its own phrase and each created on a separate, verified device. One compromised phrase now exposes ₹10 lakh, one quarter of the sleeve. The arithmetic is 40 divided by 4, and it illustrates concentration only. It sets no wallet count for anyone.
Splitting also adds work: four phrases to store, four devices to trust. Each one is a new place for a mistake. Self-custody moves the burden of verification onto you, and that burden grows with the amount.
How is institutional custody different from holding your own phrase?
Self-custody and custody each carry a different risk, and neither is risk-free. With a phrase of your own, the risk is that you or the device you trusted leaks it, and nobody can undo the result. With custody held by an institution, the risk shifts to the institution's controls, and you rely on how it is run and how openly it reports. Platforms fail too, and our timeline of dated Indian platform incidents shows how.
At Qatobit, custody is institutional custody, and Proof of Reserves is published live, so what is held can be checked rather than taken on trust. That describes how it works and ranks nothing against self-custody. A reader who holds some coins in their own wallet and some on a platform is managing two different kinds of exposure, and each needs its own checks.
Where to go next
If you want the other half of this question, what a cold wallet protects and what it cannot, read our piece on what a cold wallet protects. A custodian's holdings can be checked too, and the walk-through is in how to read a Proof of Reserves attestation. Investing in a basket through institutional custody, such as QSI Growth, means the phrase question is no longer yours to carry.
Frequently asked questions
What is a seed phrase?
A seed phrase is a list of words, 24 on a Ledger device, that recreates every private key in a crypto wallet. Anyone holding the words can move all the coins in that wallet.
Can a hardware wallet give someone else my seed phrase?
A tampered one can. Ledger confirmed on 10 October 2026 that at least one device sold by the reseller CryptoBilis contained an unauthorized hardware implant, which is why buying only from the maker matters.
Should I ever type my seed phrase into a website?
No. No genuine site, app or support agent needs it, and Ledger says it will never ask for the 24-word phrase by call or message.
What did Ledger tell affected buyers to do?
Ledger's guidance is to not initialize unused devices, and to move to a new seed on a device from Ledger if one is already set up.
Is custody safer than self-custody?
Each carries a different risk, so neither is safer in every case. Self-custody puts the risk in your device and your habits, and institutional custody puts it in the institution's controls and reporting.
Crypto investments are subject to market risk. Not financial advice.
“A better allocation begins with a better explanation.”
Qatobit principle
Published construction. Fixed cadence. Versioned control.
