How to Verify Crypto Wallet Security and Track AI Agent Activity

A crypto wallet can look new and still arrive compromised

A sealed box promises a fresh start. That promise gets complicated when the device inside is a hardware wallet meant to protect cryptocurrency. In episode 489 of Smashing Security, Graham Cluley and guest Lianne Potter investigate what might be hiding in a brand new wallet, with a Geiger counter and a cat in the mix. The setup is playful; the underlying question is serious: how much should you trust a security device before you can verify it?

The episode also turns to malicious ads that target journalists with zero-click attacks, then examines what AI agents are doing on employees’ laptops. Spencer Thompson of Origin joins the show to discuss that last question. For anyone responsible for security, the episode’s thread is clear: risks can sit inside ordinary tools and routines, beyond what a user expects to see.

Listen to episode 489 of Smashing Security, featuring cybersecurity expert and keynote speaker Graham Cluley and special guest Lianne Potter.

The gap in AI monitoring is straightforward: many teams can see the prompt and the output, but not the actions in between. Origin says its endpoint sensor records an agent’s activity as a continuous trace, including what it was asked to do, what it accessed, and what it changed. The pitch is aimed at agents that cloud gateways may miss, such as terminal based coding tools, local agents, and software communicating with an MCP server on a laptop. The goal is to make an agent’s actions traceable when something goes wrong. More detail is available at originhq.com/smashing. The conversation then turns to gadgets and trust. Lianne Potter says she enjoys them but avoids being an early adopter: past purchases have disappointed, and she remembers the “red circle of death” in video games. Graham Cluley has recently bought a Geiger counter, which he uses to run a game called “Click or Treat.” He describes a cat in a box, invoking Schrödinger’s cat, and asks Lianne to judge how trustworthy several offers seem before he checks the counter. First up: a Rolex offered for £30 by a man in a pub car park. Lianne is wary, and the counter clicks. A sealed iPhone offered for half price by an online auction seller with no reviews also sets it off. She jokes about whether the watch might turn her wrist green or the phone might melt her face. Then comes a USB stick marked “payroll,” found on a car park floor. Lianne knows it’s suspicious, though admits curiosity might tempt her to plug it in. Cluley calls it a classic penetration testing trick: leave a drive where someone might pick it up and connect it to a work computer. The counter goes wild. The final test is a hardware wallet for cryptocurrency, bought new from a major electronics retailer and sold by a respected company. Lianne judges it safe; the counter stays quiet. She wins the prize: permission to open the box and see the cat.

A trusted wallet can still be compromised

The unsettling point here is that a device can look legitimate and still be dangerous. Graham Cluley uses Schrödinger’s cat as a setup: when the box is opened, the cat has died, and the lesson is that a threat may have no visible warning. In this case, a man in Germany bought a cryptocurrency hardware wallet from a high street store and found a hidden spy chip inside. A hardware wallet is meant to keep cryptocurrency keys offline. Instead of leaving coins on an exchange, where accounts can be hacked or funds lost if a company collapses or disappears, owners can store their keys on a small device with a screen and buttons. That makes remote theft harder, but it doesn’t protect against a device that’s been tampered with before it reaches its owner. Ledger, a French manufacturer that says it has sold millions of wallets, is one of the best-known names in the category. During setup, its devices display a 24-word recovery phrase. Anyone who gets those words can access the funds from anywhere, with no password required. The phrase is powerful enough that hiding it becomes its own security problem: Lianne Potter jokes about scattering the words across Post-it notes in books, only to risk donating one of those books to a charity shop. Cluley’s alternative is burying the phrase in the garden, pirate costume optional. The stakes are already visible. Earlier this month, Ledger began investigating reports of emptied wallets. Experts estimated losses at about $100 million, taken from roughly 315 accounts holding Bitcoin, Ethereum and other cryptocurrencies. Investigators found an extra circuit board inside the devices, along with a tiny antenna. That’s a more serious failure than a stolen recovery phrase: offline storage only helps if the hardware itself can be trusted. The fragment doesn’t explain exactly how the added components enabled the theft, but the central warning is clear. A familiar brand and sealed packaging don’t prove a device is safe.