According to investigators, the device was compromised at the point of manufacture. The private key was stolen long before the investor ever used the device—allowing the scammers to drain all funds within hours of activation. The funds were then laundered through a series of obscure platforms, making recovery virtually impossible.

“When purchasing a cold wallet, choose only trusted sources. Most options online are fake,” cautioned Hella, a former Bitmain engineer, who revealed that the victim was a close friend.

The investor made the purchase through Douyin Shop, a third-party marketplace on the popular social platform. What appeared to be a “factory-sealed” device turned out to be a carefully constructed trap. Within hours, all assets were moved, eventually routed through the Huiwang network—operated by Cambodia-based Huione Group, which runs payment and crypto services and is frequently cited in blockchain crime reports.

Huione Guarantee, the conglomerate’s dark web marketplace, has been identified by Elliptic analysts as the world’s largest illicit crypto marketplace, with over $24 billion in transactions as of early 2025.

23pds, head of information security at SlowMist, reiterated that the price savings on “cheap” wallets are an illusion:
“This isn’t saving money—this is tossing your entire life away. Don’t gamble with your wealth for the sake of a few hundred dollars.”

Fraud involving hardware wallets is notoriously difficult to trace, as supply chains often involve unwitting third parties. While SlowMist was able to track the stolen assets, hopes for recovery remain slim.

According to a June 2024 industry report on crypto losses, phishing malware and negligent wallet handling ranked as the second most common cause of lost assets globally—highlighting the critical need for vigilance and secure purchasing practices in the rapidly evolving crypto landscape.