What is the TikTok hardware wallet scam?

A person who bought what looked like a “sealed, brand-new” hardware wallet advertised on the Chinese version of TikTok was a victim of a $6.9-million crypto heist, losing all their funds in minutes.

A late-night distress call to blockchain security firm SlowMist revealed one of 2025’s most devastating cryptocurrency thefts. Criminals are now exploiting the very security devices meant to protect users from online threats. It’s a sophisticated new threat in crypto fraud, and honestly, it’s a worry for many users to see hardware wallet tampering result in a multimillion-dollar criminal exploit.

SlowMist chief information security officer 23pds was the first to report the case. Unlike well-known scams using phishing emails, unsolicited messages or spoof websites, this attack hits the victim’s security at the hardware level.

The biggest problem of all for crypto users is that there are minimal warning signs for this type of compromise until it’s too late. 

How are counterfeit hardware wallets compromised?

The victim bought what appeared to be a legitimate Ledger hardware wallet from Douyin Shop, the e-commerce platform inside the Chinese social media version of TikTok. 

For security, you should never buy a second-hand, unsealed hardware wallet in case it has been compromised. But in this case, the buyer was tricked by the packaging. It appeared to be a factory-sealed, authentic product, complete with the original holographic stickers and a professional finish. To the unassuming users, there was nothing different or alarming about this Ledger wallet. 

In this case, when the victim set up their new wallet, it functioned completely normally, generating the usual random 24-word recovery phrase. Unfortunately, investigators would eventually determine that this was the moment the wallet was compromised before it was sold. 

In reality, the attackers had already predetermined the secret phrase or compromised the process for generating numbers. This gave them complete access to the wallet and its private keys. So, when funds were transferred to the wallet, the attackers were able to drain it instantly. 

Unfortunately, the victim had deposited around 50 million Chinese yuan ($6.9 million) into the wallet address, thinking everything was secure in cold storage. However, within hours, the criminals had emptied the wallet. 

Did you know? The global hardware wallet market was valued at over $460 million in 2024, and it is predicted to grow to over $3 billion by 2033. This makes hardware wallets, which users trust heavily, a prime target for crypto theft.

SlowMist team’s crypto investigation trail

As reported on the SlowMist X account, the victim filed an emergency report regarding the theft on June 13, 2025. 

SlowMist is a blockchain security firm that offers a number of services, including security audits and threat information and works extensively in cryptocurrency crime investigations. Its work often extends to large organizations and government bodies. 

On this occasion, it was able to trace the stolen funds, revealing they were immediately funneled through Huiwang, a shadowy entity in Cambodia. This operation was using a financial network called Huione Group, which operates “a node for laundering proceeds of cyber heists,” according to the Financial Crimes Enforcement Network, or FinCEN. 

Huiwang crypto laundering is a popular financial move for criminals, as multiple layers of obfuscation, coupled with no Anti-Money Laundering (AML) or Know Your Customer (KYC) controls, make recovery virtually impossible. So, while SlowMist could track the stolen funds, there is little hope of recovery after the cold wallet key leak. 

Did you know? TikTok and similar social media platforms are hotbeds for crypto scams. The fraud ranges from fake investment opportunities, viral video scams, unsolicited messages and compromised hardware wallet sales — all designed to con unsuspecting users out of their crypto stash. 

The growing sealed wallet crypto theft problem

The cold wallet scam shows how quickly you can lose an entire crypto stash in seconds. SlowMist’s chief security officer, 23pds, explained on X that crypto users shouldn’t gamble their “entire fortune on a ‘wallet’ that’s a few hundred bucks cheaper.” He went on to say, “This isn’t saving money, it’s throwing away your lifeline.”

Incidents like these are part of a broad surge in cryptocurrency-related fraud that is plaguing 2025. The first half of the year has seen over $2.1 billion in crypto losses across infrastructure-level attacks. 

Hardware wallet manipulation is another sophisticated vulnerability that crypto holders need to be aware of. No matter how “legitimate” a wallet product may appear, this case highlights the importance of purchasing brand-new devices directly from suppliers. It’s critical to avoid other sources, especially discount or marketplace platforms. 

Security experts have also identified multiple ways criminals can compromise hardware wallets further:

• Firmware modification: Attackers replace legitimate firmware with malicious versions that leak private keys.
• Manual replacement: Criminals include fake setup instructions directing users to pre-generated addresses.
• Supply chain infiltration: Wallets are intercepted and modified during shipping or retail distribution.
• Counterfeit manufacturing: Complete fake devices that mimic legitimate hardware wallets.

Did you know? Even one of the world’s biggest crypto firms, Coinbase, is susceptible to cyberattacks, with the company recently admitting that criminals had accessed data that was used to trick people into handing over their crypto. The criminals demanded $20 million to keep it quiet, but they refused to pay and promised to refund any person who got scammed.

How to protect against hardware crypto wallet scams

With the cryptocurrency industry worth over $3 trillion, it has become an attractive target for criminals, particularly hardware wallets, where users trust these devices to store significant funds for long periods of time. 

This means users need to take precautions to buy a crypto wallet safely and protect against private key theft:

• Packaging inconsistencies: Legitimate hardware wallet packaging uses ultrasonic welding in conjunction with tamper-proof seals. Devices held together with glue, missing exterior security packaging or preopened are major red flags.
• Cheap pricing: Wallets sold for less than the official retail price, especially on social media platforms or through unofficial channels, are likely counterfeit or compromised.
• Pre-filled information: Any wallet that comes with preset PINs, recovery phrases or setup instructions should be immediately destroyed.
• Unofficial marketplaces and retailers: Purchasing from anywhere other than the manufacturer’s official website significantly increases risk.

Binance founder Changpeng Zhao (CZ) has sounded a fresh alarm on the growing threat of AI-powered deepfakes, after a chilling real-life hack compromised Japanese crypto advocate Mai Fujimoto during a routine video call.

The incident has renewed calls for stricter security habits as criminals wield advanced AI to breach even trusted communication channels.

A Case Study in Modern Hacking

On June 20, Fujimoto, better known online as Miss Bitcoin, narrated how she fell victim to a deepfake after being tricked into a Zoom call with an acquaintance whose Telegram account had already been compromised.

According to her, the person on the video link was familiar, causing her to let down her guard. “For about 10 minutes in the online meeting, I saw her face but had no clue it was a deepfake,” Fujimoto recounted.

However, there were audio issues with the call, prompting the deepfake impersonator to send a link supposedly meant to fix the problem. After clicking the link, Fujimoto unknowingly installed malware that compromised her Telegram and MetaMask. Her main X account was also hijacked, forcing her to plead with followers to report it as impersonation. She also warned users of the social platform not to click any links sent from the account.

“If I had known about this kind of attack, I might not have clicked the link,” the crypto enthusiast lamented, urging widespread awareness.

Her ordeal struck a chord across the crypto community, with influencers and security experts flooding X with stern reminders that in the age of AI, trust must be verified through multiple channels.

CZ weighed in, too, warning his 10 million followers of the rampant use of artificial intelligence in new kinds of deepfake hackings. “Even a video call verification will soon be out of the window,” he cautioned, suggesting AI-generated impersonations will become harder to detect as the technology improves.

The former Binance head urged users never to install software from unofficial links, even if they appear to come from friends.

The Rise of AI-Powered Fraud

The attack on Fujimoto is hardly isolated. A major report released by Bitget only days ago revealed that deepfake technology had played a role in nearly 40% of all high-value crypto frauds in 2024, contributing to at least $4.6 billion lost to scams.

The study documented criminals using AI to create convincing fake videos of public figures like Elon Musk promoting scams, simulating customer service chats, and crucially, weaponizing video conferencing tools like Zoom with malicious links.

Additionally, a different publication by Chainalysis noted that lawbreakers were increasingly using AI tools, including deepfakes, to bypass KYC measures and automate fraud, making crypto cons “increasingly difficult to detect.”

In one such instance, Hong Kong police arrested 31 individuals linked to a syndicate that stole $34 million using AI-generated videos of crypto executives. Terrifyingly, the report warned that AI-driven swindles are poised to grow significantly.

ether

It recovers firmly from its main support of nearly $2,460, recovers losses and remains stable above the $2,500 threshold amid wider market volatility.

The rally shows increased market reliability following higher lower levels supported by above average volumes.

Institutional participation appears to be strengthening the trend as reported by BlackRock Etha ETF, which reported $492 million in net inflows last week.

Currently, its holdings exceed $4.844 billion, reinforcing long-term bullish sentiment, despite price action remaining sensitive to geopolitical development.

Traders are checking if ETH can challenge resistance in the $2,520-$2,530 range.

Technical Analysis Highlights

• ETH traded between $2,460.35 and $2,532.41 over a 24-hour period, within the $72 range.
• In the main support zone, formed at $2,460-$2,470, the ETH bouncing off at strong volume in the middle of the night.
• The final time surge reached $2,515.11, supported by a volume of 5,919 ETH.
• A higher and lower structure is established at $2,485 with interim support and $2,503 with resistance.
• The final retracement was supported at $2,507, with prices ending at around $2,510.

Disclaimer: Some of this article was generated with the support of AI tools and reviewed by our editorial team to ensure accuracy and compliance with the standards. For more information, see Coindesk’s complete AI policy.