Worked example · 2025-01

Counterfeit Ledger Nano S Plus hardware-wallet supply-chain compromise cohort — multi-chain — 2025 (cohort surfacing)

Loss: publicly-reported confirmed losses of approximately ~$9.5M+ across ~50+ documented victims, spanning 20+ blockchain ecosystems, per the Brazilian-cybersecurity-researcher disclosure that surfaced the cohort in 2025. The realised cohort-level loss is strongly understated — counterfeit hardware wallets are typically purchased through informal Chinese-marketplace channels (AliExpress / Taobao third-party sellers, Telegram-based resellers, in-person counterfeit-product markets) and per-victim testimonies are concentrated in Reddit / r/CryptoCurrency / r/Ledger / Brazilian-Portuguese-language Reddit and Telegram channels rather than centrally tabulated. Multiple parallel cohorts of counterfeit-hardware-wallet-driven loss have been documented through 2017–2025 (Ledger Nano S 2017 inserts, Trezor counterfeit Model T 2023 cohort, Ledger Nano S Plus 2025 cohort); the 2025 Brazilian-researcher disclosure is the cleanest single-cohort anchor with quantified loss data at v0.1 reporting horizon.
Recovery: none documented at v0.1 for the affected cohort. The counterfeit hardware was distributed through Chinese-marketplace channels with no formal vendor relationship; on-chain proceeds were laundered through standard mixing rails; no civil-recovery action against the counterfeit-distribution operators has been publicly filed; no class-action filed against Ledger / SatoshiLabs (the counterfeiters' brand impersonation is not the legitimate vendor's responsibility). Affected individuals absorbed the loss; defender-side recovery is limited to (a) public-record warning-publication by Ledger / Trezor advising users to purchase only from authorised retail channels, (b) authorised-retailer verification programmes (Ledger's tamper-evident packaging, Trezor's holographic seal), and (c) industry-press cohort framing.
OAK Techniques observed: OAK-T11.007 (Hardware-wallet Supply-chain / Physical-access Compromise), OAK-T11.007.001 (Counterfeit-Hardware Substitution) — canonical anchor case (deployed-attack dimension). Complements the Trezor RDP-downgrade case at examples/2020-01-trezor-kraken-rdp-downgrade.md (T11.007.002 capability anchor). The case shape is: counterfeit hardware that brand-impersonates a legitimate hardware-wallet product, with the counterfeit unit's internal architecture replaced by an attacker-controlled microcontroller (Espressif ESP32-S3 in the 2025 cohort, with the chip markings physically scraped off to obscure the architecture identification) that stores the user's seed phrase and PIN in plaintext flash memory and exfiltrates them via embedded radio (2.4 GHz Wi-Fi / BLE, an antenna trace identified on the counterfeit PCB). The legitimate Ledger Nano S Plus is air-gapped by design with no radio hardware; the counterfeit substitutes a network-connected microcontroller for the secure element. Distinct from T11.002 (wallet-software distribution compromise) — T11.002 substitutes the software the user runs on a legitimate device; the counterfeit-Ledger sub-class substitutes the hardware itself, with the legitimate-vendor's branding as the social-engineering surface that produces user-side trust. Distinct from the pre-seeded recovery-card scam sub-pattern — pre-seeded scams use a legitimate-or-cloned device with a pre-supplied recovery card; the counterfeit-Ledger sub-pattern uses a fully-replaced hardware unit. OAK-T7.001 chains downstream as proceeds were laundered through standard EVM and multi-chain mixing rails.
Attribution: unattributed for the Brazilian-researcher 2025 disclosure (the disclosure surfaces a coordinated supply-chain operation with cross-platform malware deployment — hardware, Android, Windows, macOS, iOS via Apple TestFlight — that produces the counterfeit-hardware sub-pattern as one component of a multi-vector campaign); pseudonymous at the per-incident named-individual level (no DOJ named-individual indictment, no federal-record action; the operators behind the counterfeit-distribution rings are typically pseudonymous Chinese-marketplace sellers reachable only through the marketplace's seller-account interface). The cohort attribution is inferred-strong because the multi-platform / multi-vector / cross-blockchain-ecosystem coordination of the operation indicates a structured operator-cluster rather than an opportunistic single-operator effort, even where the named-individual attribution is absent.
Key teaching point: a hardware wallet purchased outside authorised retail channels is structurally indistinguishable from a deliberate seed-exfiltration device, and the legitimate-vendor's brand impersonation is the social-engineering surface that produces user-side trust. The structural OAK lesson is that hardware-wallet supply-chain authenticity is itself a first-class user-side T11 mitigation surface — the wallet's cryptographic correctness (secure element architecture, firmware integrity, BIP39 implementation) is meaningful only if the device the user holds is the device the legitimate vendor produced. The defender lesson is that hardware-wallet purchase-channel verification (authorised-retailer purchase, tamper-evident packaging inspection, vendor-side authenticity verification via the vendor's official Ledger Live / Trezor Suite app's device-genuineness check) is mandatory for any user with non-trivial holdings; informal-channel purchases (Chinese marketplaces, Telegram resellers, in-person counterfeit-product markets, second-hand purchases without packaging) should be treated as structurally compromised regardless of how legitimate the device appears. The case is also the canonical example of brand-impersonation-driven hardware supply-chain in the v0.1 OAK corpus and complements the Trezor RDP-downgrade capability anchor in establishing the breadth of the proposed T11.x hardware-wallet-supply-chain / physical-access compromise sub-class.

Summary

Ledger Nano S Plus is a Ledger SAS hardware-wallet product (released 2022) with a Common-Criteria-certified secure element architecture and air-gapped design (no radio, no network connectivity beyond the USB-C interface). The legitimate device is sold through Ledger's authorised retail channels — Ledger's official online store (ledger.com), authorised retailers (Best Buy, Amazon-via-direct-Ledger-store-only, regional authorised partners), and a small number of physical retail partners. Outside the authorised retail channels, a parallel ecosystem of counterfeit Ledger devices has existed since at least 2017 and has produced a recurring cohort of supply-chain-compromise incidents.

In 2025, a Brazilian cybersecurity researcher publicly disclosed a sophisticated counterfeit-Ledger-Nano-S-Plus supply-chain operation distributed primarily through Chinese-marketplace channels (AliExpress / Taobao third-party sellers, Telegram resellers, in-person counterfeit-product markets). The disclosure characterised the cohort with quantified loss and victim data:

~$9.5M+ confirmed cumulative loss across ~50+ documented victims.
20+ blockchain ecosystems affected (the counterfeit firmware was multi-chain, supporting Bitcoin, Ethereum, Solana, BNB Chain, Polygon, Avalanche, Arbitrum, Optimism, Base, and other chains the legitimate Ledger Nano S Plus supports).
Multi-platform malware infrastructure: the counterfeit operation included not only the hardware substitution but also trojanised companion apps for Android, Windows, macOS, and iOS (via Apple TestFlight, exploiting TestFlight's looser app-review process for beta apps).

The technical architecture of the counterfeit Ledger Nano S Plus (per the Brazilian researcher's teardown analysis):

Replaced microcontroller: the counterfeit substitutes the legitimate device's secure element with a generic IoT microcontroller — the Espressif ESP32-S3 — with the chip markings physically scraped off the package to obscure the architecture identification. The ESP32-S3 is a low-cost general-purpose microcontroller with built-in 2.4 GHz Wi-Fi and Bluetooth Low Energy radio, none of which the legitimate Ledger Nano S Plus has.
Plaintext seed-phrase storage in flash: the counterfeit firmware stores the user's seed phrase and PIN in flash memory in plaintext, with no encryption. The legitimate device stores key material inside the secure element's protected memory with hardware-enforced access controls.
Antenna trace on PCB: the counterfeit PCB has an antenna trace for 2.4 GHz Wi-Fi / BLE radio. The legitimate Ledger Nano S Plus is air-gapped by design with no radio or network hardware.
Visual-fidelity brand impersonation: the counterfeit's external appearance, packaging, and printed materials closely resemble the legitimate device. Per security-researcher Mike Grover's analysis (cited in the broader cohort coverage), older counterfeit cohorts (pre-2025) sometimes used cruder modifications — "a simply flash drive strapped on to the Ledger" with "those 4 wires piggyback the same connections for the USB port of the Ledger" — but the 2025 cohort exhibits a fully-redesigned counterfeit unit rather than a modified-legitimate device.

The counterfeit-driven loss vector operates as follows:

User purchases the counterfeit unit through an informal channel (Chinese marketplace, Telegram reseller, in-person counterfeit-product market).
User initialises the device per the (counterfeit-firmware-controlled) on-screen prompts; the firmware leads the user through what appears to be the legitimate Ledger setup flow.
Either: the user is prompted to enter an existing seed phrase (in which case the counterfeit firmware captures it directly and exfiltrates via the embedded radio); or the user is prompted to generate a new seed phrase (in which case the counterfeit firmware generates a seed it has logged, displays it to the user as if it were freshly-generated, and exfiltrates via the embedded radio).
The user funds the wallet, believing it to be a legitimate Ledger-secured cold wallet. The attacker, having captured the seed phrase at initialisation time, drains the wallet at any chosen subsequent moment — typically waiting for the wallet balance to grow before extracting (a recurring pattern in the cohort).

Per Kaspersky's parallel coverage of counterfeit Trezor Model T cohorts (May 2023, separate but adjacent cohort): "the fake wallet operated normally while attackers had full control from the beginning, and they waited a full month after the wallet was credited before stealing the money." The same pattern is observed in the counterfeit-Ledger cohort.

For OAK's purposes the case is the cleanest deployed-attack anchor in the public record for the proposed T11.x hardware-wallet-supply-chain / physical-access compromise sub-class. The case complements the Trezor RDP-downgrade case at examples/2020-01-trezor-kraken-rdp-downgrade.md (capability anchor) — the two cases together establish the breadth of the proposed sub-class across the capability and deployed-attack dimensions. The case is the canonical worked example for brand-impersonation-driven hardware supply-chain in the v0.1 OAK corpus.

Timeline (UTC)

When	Event	OAK ref
2017 onward	Counterfeit Ledger Nano S devices begin appearing in informal retail channels; recurring per-victim testimonies through 2017–2024	(cohort surface establishes — pre-2025 baseline)
2017-12 onward	Wallet supply-chain advisory from Ledger advising authorised-retailer purchase only; tamper-evident packaging introduced; device-genuineness check via Ledger Live	(vendor-side mitigation surface published)
2020 (separate cohort)	Bitcoin Magazine, "Inside The Scam: Victims Of Ledger Hack Are Receiving Fake Hardware Wallets" — counterfeit devices mailed to victims of the Ledger 2020 customer-data breach	(parallel cohort — phishing-driven counterfeit distribution)
2023 (separate cohort)	Kaspersky discloses counterfeit Trezor Model T cohort with similar architecture (replaced microcontroller, plaintext seed storage, exfiltration radio)	(parallel cohort — Trezor brand impersonation)
2025	Brazilian cybersecurity researcher publicly discloses counterfeit Ledger Nano S Plus cohort: ~$9.5M+ cumulative loss across ~50+ victims; 20+ blockchain ecosystems; multi-platform malware infrastructure	T11.x deployed-attack cohort anchor — quantified disclosure
2025 onward	Industry press covers the disclosure (Tom's Hardware, Cybersecurity News, crypto.news, others); Ledger publishes updated authorised-retailer-purchase guidance	(cohort-level attribution + vendor-side response)
Continuing	The counterfeit-distribution channels remain active at v0.1 reporting horizon (May 2026); informal-channel hardware-wallet purchases remain structurally compromised	(open cohort surface)

What defenders observed

Hardware-wallet supply-chain authenticity is a first-class user-side T11 mitigation surface. The wallet's cryptographic correctness (secure element architecture, firmware integrity, BIP39 implementation) is meaningful only if the device the user holds is the device the legitimate vendor produced. Defender practice for any user with non-trivial holdings should treat hardware-wallet purchase-channel verification (authorised-retailer purchase, tamper-evident packaging inspection, vendor-side authenticity verification via the vendor's official Ledger Live / Trezor Suite app's device-genuineness check) as mandatory; informal-channel purchases (Chinese marketplaces, Telegram resellers, in-person counterfeit-product markets, second-hand purchases without packaging) should be treated as structurally compromised regardless of how legitimate the device appears.
Brand-impersonation-driven hardware supply-chain is a recurring cohort with a multi-decade history. The first counterfeit Ledger Nano S cohorts surfaced in 2017; the 2025 Ledger Nano S Plus cohort is the latest in a continuous lineage. Defender practice should treat the cohort as persistent rather than as a single-incident event; vendor-side mitigation (authorised-retailer programmes, tamper-evident packaging, device-genuineness checks) reduces but does not eliminate the cohort surface. Contributors writing future T11.x worked examples should preserve the cohort-persistence dimension explicitly.
The counterfeit's architectural-fingerprint is detectable via teardown but not via casual inspection. The Brazilian researcher's teardown analysis identified the ESP32-S3 microcontroller, the antenna trace on the PCB, and the plaintext seed-phrase storage in flash memory as architectural-fingerprint signals. Casual inspection does not reveal these signals — the counterfeit's external appearance, packaging, and printed materials closely resemble the legitimate device. The defender lesson is that architectural-fingerprint detection requires teardown-class analysis that is not operationally available to most end users; the user-side mitigation surface is therefore purchase-channel verification, not post-purchase architectural verification.
The counterfeit-firmware's wait-for-balance-to-grow extraction pattern is a recurring cohort feature. Per Kaspersky's adjacent counterfeit-Trezor cohort coverage, "the fake wallet operated normally while attackers had full control from the beginning, and they waited a full month after the wallet was credited before stealing the money." The same pattern is observed in the Ledger Nano S Plus cohort. The defender lesson is that the absence of an immediate drain after device initialisation does not indicate the device is legitimate; the counterfeit-firmware's extraction pattern is delayed-extraction-after-funding, and the realised loss accrues at the time of attacker-chosen extraction rather than at the time of device initialisation.
The multi-platform malware infrastructure dimension extends the cohort beyond hardware substitution. The Brazilian researcher's disclosure characterised the counterfeit operation as a multi-platform / multi-vector campaign that includes trojanised companion apps for Android, Windows, macOS, and iOS (via Apple TestFlight). The defender lesson is that the cohort's attack surface is broader than the counterfeit hardware alone — even users who purchase legitimate Ledger devices but install trojanised companion apps may be exposed to the same operator-cluster's broader infrastructure. Contributors writing future T11.x worked examples should report the multi-platform infrastructure dimension explicitly where it is documented.
Apple TestFlight as a malware-distribution vector is an under-appreciated mobile-platform supply-chain surface. TestFlight's beta-app-review process is structurally looser than the standard App Store review process; the 2025 cohort exploits this gap to distribute trojanised companion apps. Defender practice for mobile-platform users with non-trivial crypto holdings should treat TestFlight-distributed beta apps as higher-risk than App-Store-distributed apps and should evaluate any TestFlight-distributed wallet-companion app against the same authorised-distribution criteria applied to hardware-wallet purchase channels.

What this example tells contributors writing future Technique pages

The proposed T11.x hardware-wallet-supply-chain / physical-access compromise sub-Technique needs to cover both research-disclosed capability cases and deployed-attack cohort cases. The Trezor RDP-downgrade case at examples/2020-01-trezor-kraken-rdp-downgrade.md anchors the capability dimension; the counterfeit Ledger Nano S Plus 2025 cohort anchors the deployed-attack dimension. Contributors writing the proposed sub-Technique page should preserve the dual-anchor structure explicitly and should articulate the relationship between the two dimensions.
Brand-impersonation-driven supply-chain compromise generalises beyond hardware wallets. Contributors writing future supply-chain-compromise worked examples should preserve the brand-impersonation dimension explicitly. The 2025 Ledger Nano S Plus cohort, the 2023 counterfeit Trezor Model T cohort, the 2017 counterfeit Ledger Nano S cohort, and parallel cohorts in non-hardware-wallet categories (counterfeit USB drives, counterfeit YubiKeys, counterfeit phone-charging-cable / O.MG cables, counterfeit-NFC card readers) all share the structural pattern. The OAK Mitigations layer should pre-position purchase-channel authenticity verification as a first-class user-side mitigation across the broader supply-chain-compromise category.
Cohort-tabulation reports should include cumulative-loss + victim-count + ecosystem-breadth dimensions explicitly. The Brazilian researcher's 2025 disclosure includes (a) ~$9.5M+ cumulative loss, (b) ~50+ documented victims, (c) 20+ blockchain ecosystems. Contributors writing future T11.x deployed-attack cohort worked examples should report the same three dimensions explicitly to enable cross-cohort comparison.
Multi-platform infrastructure dimension is operationally meaningful and should be reported. The 2025 counterfeit-Ledger cohort includes hardware substitution + trojanised Android / Windows / macOS / iOS-via-TestFlight companion apps. Contributors writing future T11.x deployed-attack cohort worked examples should report the multi-platform infrastructure dimension explicitly where it is documented; the broader operator-cluster's infrastructure typically extends beyond the proximate-cohort anchor.
The wait-for-balance-to-grow extraction pattern is a recurring counterfeit-hardware feature that contributors should document. The pattern is structurally informative: the counterfeit firmware does not extract immediately after device initialisation, it waits for the wallet to be funded and then extracts at an attacker-chosen subsequent moment. Contributors writing future T11.x worked examples in the counterfeit-hardware sub-class should report the extraction-timing pattern explicitly and should not over-anchor on "no immediate drain → device must be legitimate" as a defender-side heuristic.
Apple TestFlight as a malware-distribution vector deserves explicit framing in the OAK Mitigations layer. Contributors writing future T11.002-adjacent or T11.x-adjacent worked examples involving mobile-platform companion apps should preserve the TestFlight dimension explicitly. TestFlight's beta-app-review looseness creates a structural mobile-platform supply-chain surface that the standard App Store review process closes; defender practice for mobile-platform users should evaluate TestFlight apps against the same authorised-distribution criteria applied to hardware-wallet purchase channels.

Public references

[highboycounterfeitledger2025] — "$9.5M Counterfeit Ledger Teardown" (research.highboy.com.br); primary teardown-analysis source for the 2025 cohort, including the ESP32-S3 microcontroller identification, the plaintext seed-phrase storage in flash, the antenna trace on the PCB, and the multi-platform malware infrastructure characterisation.
[tomshardwarecounterfeitledger2025] — Tom's Hardware, "Techie buys fake Ledger Nano S+ hardware crypto wallet and almost falls for phishing — a convincing clone would have caught newbies unaware"; primary press-coverage source for the 2025 cohort.
[cybersecuritynewsledger2025] — Cybersecurity News, "Fake Ledger Hardware Wallets on Chinese Marketplaces Steal Crypto Seeds and PINs" (2025–2026); primary press-coverage source for the cohort distribution channels.
[cryptonewsledgers2025] — crypto.news, "Researcher uncovers fake Ledger Nano S modified to siphon crypto assets"; primary press-coverage source.
[ledgerpreseedscamadvisory] — Ledger official, "Pre-Seed device Scams" (support.ledger.com/article/pre-seed-device-scam); primary vendor-side advisory.
[ledgersecurelybuy2024] — Ledger official, "Best Practices To Securely Buy Your Ledger Signer"; primary vendor-side authorised-retailer-purchase guidance.
[kasperskytrezorfake2023] — Kaspersky, "Review and analysis of fake Trezor cryptowallet" (May 2023); parallel-cohort source for the counterfeit Trezor Model T architecture and the wait-for-balance-to-grow extraction pattern.
[bitcoinmagazineledgerfakehw2021] — Bitcoin Magazine / Nasdaq, "Inside The Scam: Victims Of Ledger Hack Are Receiving Fake Hardware Wallets" (June 2021); parallel-cohort source for the post-2020-Ledger-data-breach counterfeit-distribution surge.
[snouthardwallettampering] — snout0x.com, "Hardware Wallet Supply Chain Attack: How to Spot Tampering"; defender-side detection-methodology source.

Citations

Existing citation keys reused: none — this is the first OAK example in the counterfeit-hardware-wallet supply-chain sub-class.

Proposed new BibTeX entries (added to citations.bib as part of this batch):

[highboycounterfeitledger2025] — Brazilian-researcher teardown analysis; primary technical source.
[tomshardwarecounterfeitledger2025] — Tom's Hardware primary press source.
[cybersecuritynewsledger2025] — Cybersecurity News primary press source.
[cryptonewsledgers2025] — crypto.news primary press source.
[ledgerpreseedscamadvisory] — Ledger official advisory.
[ledgersecurelybuy2024] — Ledger official authorised-retailer guidance.
[kasperskytrezorfake2023] — Kaspersky parallel-cohort coverage.
[bitcoinmagazineledgerfakehw2021] — Bitcoin Magazine parallel-cohort coverage.
[snouthardwallettampering] — snout0x.com defender-side detection-methodology source.

Discussion

The counterfeit Ledger Nano S Plus hardware-wallet supply-chain compromise cohort (2025 disclosure, with cohort lineage extending back to 2017 across multiple vendor brands) is OAK's canonical v0.1 deployed-attack anchor for the proposed T11.x hardware-wallet-supply-chain / physical-access compromise sub-class. The case complements the Trezor RDP-downgrade capability anchor at examples/2020-01-trezor-kraken-rdp-downgrade.md in establishing the breadth of the proposed sub-class across the capability and deployed-attack dimensions.

The structural significance for the broader T11 framework is the empirical demonstration that hardware-wallet supply-chain authenticity is a first-class user-side T11 mitigation surface that the v0.1 framework does not currently cover. The dominant v0.1 T11 sub-Techniques (T11.001 signing-vendor UI compromise, T11.002 wallet-software distribution compromise, T11.003 in-use multisig contract manipulation) all assume the user holds a legitimate hardware-wallet device or runs legitimate wallet software; the counterfeit-hardware cohort introduces the brand-impersonation-driven supply-chain dimension where the user's wallet device itself is structurally compromised before the user takes any other action. The defender / Mitigations-layer lesson is that purchase-channel authenticity verification is a first-class user-side T11 control independently of the wallet's cryptographic correctness.

The case is operationally instructive in five distinct dimensions: (a) the counterfeit's architectural-fingerprint (replaced microcontroller, plaintext seed-storage, embedded radio, antenna trace on PCB) is detectable via teardown but not via casual inspection, motivating purchase-channel verification rather than post-purchase architectural verification as the user-side mitigation surface; (b) the wait-for-balance-to-grow extraction pattern is a recurring cohort feature that defeats the "no immediate drain → device must be legitimate" defender-side heuristic; (c) the multi-platform malware infrastructure dimension extends the cohort beyond hardware substitution to companion-app trojanisation across mobile and desktop platforms; (d) the Apple TestFlight distribution vector is an under-appreciated mobile-platform supply-chain surface that the OAK Mitigations layer should cover explicitly; (e) the cohort-persistence dimension — counterfeit-hardware-wallet cohorts have surfaced continuously since at least 2017 — establishes that vendor-side mitigation reduces but does not eliminate the cohort surface.

The case is structurally distinct from the Trezor RDP-downgrade case despite both being hardware-side T11.x examples. The Trezor RDP-downgrade case is a research-disclosed structural vulnerability in legitimate hardware where the attacker requires physical access to the user's actual device; the counterfeit-hardware case is a deployed-attack supply-chain compromise where the attacker substitutes the hardware itself and the user voluntarily transports the compromised device into their own threat model. Both cases fall under the proposed T11.x sub-class; the per-incident shape differs and contributors writing future T11.x worked examples should preserve the distinction.

The brand-impersonation-driven supply-chain dimension generalises beyond hardware wallets. The proposed T11.x sub-Technique should cover (a) counterfeit hardware wallets (Ledger / Trezor / others, covered by this case and adjacent cohorts); (b) pre-seeded recovery-card scams (where a legitimate-or-cloned device is shipped with a pre-supplied recovery card, an adjacent sub-pattern); (c) counterfeit-token / counterfeit-software-key-storage devices (YubiKey clones, NitroKey clones, Trezor-fork clones). All of these share the structural pattern of brand-impersonation-driven trust transferred to a structurally-compromised device. Contributors writing future T11.x worked examples should preserve the breadth of the sub-class explicitly.

For OAK's broader credibility, including the counterfeit Ledger Nano S Plus cohort in v0.1 closes a structural gap: the v0.1 T11 framework had no deployed-attack anchor for the hardware-wallet supply-chain compromise category, despite multiple cohorts having surfaced continuously since 2017. The case operationalises the brand-impersonation-driven supply-chain dimension into a live empirical anchor, anchors the architectural distinction between research-disclosed capability and deployed-attack supply-chain shapes, and provides contributors writing future T11.x worked examples with a tone-and-structure precedent for the deployed-attack-cohort framing.

The cohort surface remains active at v0.1 reporting horizon (May 2026). Counterfeit-distribution channels remain operational; informal-channel hardware-wallet purchases remain structurally compromised; per-victim testimonies continue to surface. Contributors maintaining this worked example post-v0.1 should treat the cohort as live and should report any further large-scale cohort disclosures (additional vendor-brand cohorts, additional architectural-fingerprint variations, additional multi-platform infrastructure surfaces) as they emerge.