ledger implant and coldcard phished in the same 48hrs. real question: do you actually verify firmware when a new wallet arrives or just trust the seal