On this page
Key takeaways
- Order a hardware wallet from the manufacturer's own store, typing the web address yourself. Treat any other seller, a marketplace store included, as a fallback, and only when the maker's own website lists it.
- Never buy secondhand, from auctions, classifieds or social media sellers, or from a listing priced well below the official store. Each of these gives a tamperer an easy way to reach you.
- When the device arrives, set it up as new, run the maker's genuine check, write down a brand-new recovery phrase yourself, and send a small test amount before moving anything larger.
A hardware wallet keeps your crypto keys offline, but it can only protect you if the device itself is honest. A unit that was altered before it reached you can leak your recovery phrase as soon as it shows on screen, or give you one the attacker already knows. This guide covers where to buy, what to avoid, and what to check when the box arrives.
Why where you buy matters
Altered wallets are not a theory. They have reached real buyers through several routes:
- Fake "replacement" devices in the mail (2021). After Ledger's 2020 customer data leak, criminals posted shrink-wrapped Ledger Nano X boxes to customers with a letter claiming the old device was unsafe. Inside, a small flash drive had been wired to the circuit board to push a fake app that asked for the recovery phrase.
- A counterfeit Trezor sold through classifieds. In a 2023 report, Kaspersky described a Trezor Model T, bought on a classifieds website, whose chip had been swapped and whose firmware drew from a short list of pre-generated recovery phrases. The holographic seals looked untouched.
- Hidden implants in October 2026. Ledger confirmed that a device belonging to one of the people drained after buying from a Southeast Asian reseller contained an unauthorized hardware implant. Separately, former Mt. Gox chief Mark Karpelès said he had ordered cheap Ledger Nano X units from sellers Ledger had not authorized, including on Amazon Japan: one never arrived and two held spy implants. Our full write-up covers what is known so far.
In each case the device looked normal from the outside. The common thread is the sales channel, which is the part you control.
Where to buy, in order of preference
- The manufacturer's own online store. This is the safest option. Type the maker's web address yourself instead of clicking an ad, a search result or a link in a message.
- The maker's official storefront on a large marketplace. Some brands sell through their own storefront on sites such as Amazon. Use it only if the maker's website links to it, and check the seller name shown at checkout, not just the store banner. Some brand-labeled stores are run by a reseller, so that name should appear on the maker's own list.
- A reseller named on the maker's own website. Ledger and Trezor both publish reseller lists. Find the list on the maker's site, not on the seller's. Treat it as a minimum standard: the October 2026 Ledger losses involved a reseller that Ledger itself had listed, so buying direct is the better choice whenever you can.
Red flags before you buy
- The price is far below the manufacturer's own store.
- The seller is not on the reseller list published on the maker's website.
- The listing calls the device "pre-configured", "ready to use" or "set up for you".
- The seller asks you to pay in crypto, or to complete the sale outside the marketplace.
- A device arrives that you never ordered, often with a letter about a "security upgrade" or "replacement". Do not plug it in.
When it arrives: a six-step check
- Look at the packaging. Compare the box and seals with the photos on the maker's website, and contact official support if anything looks opened, glued or reworked. Perfect shrink wrap is not proof on its own, because it can be redone.
- Get the app from the maker. Download the companion app only from the maker's official site or the official app store listing it links to.
- Set it up as a new device. A genuine wallet should ask you to start fresh. If it is already set up, or claims you must use a phrase that came with it, stop.
- Run the genuine check and update the firmware. Use the official app's authenticity check, and install firmware only through that app. Ledger notes that its check proves the security chip is real but cannot spot extra hardware added inside the case if that chip is left in place. A pass is good news, not a guarantee.
- Write your own recovery phrase. Let the device generate new words, write them by hand with no camera, phone or computer involved, and confirm the backup on the device. Never use words printed in the box or supplied by anyone else.
- Test with a small amount. Check the receive address on the device's own screen, send a small amount, and only then move larger sums.
If something seems wrong
- Not set up yet: leave it in the box and contact the maker's support through its official website.
- Already set up and funded: buy a new device from the manufacturer's store, create a fresh recovery phrase on it, and move your crypto there. Do not reuse the old phrase.
- Money already stolen: report it to the FBI's IC3 (opens in a new tab) and the FTC (opens in a new tab). Be wary of anyone who then offers to get it back for a fee; that is a common recovery scam.
Frequently asked questions
Is it safe to buy a hardware wallet on Amazon?
Only from the manufacturer's own storefront, where the brand itself is the seller and the maker's website points you there. Listings from other sellers on the same marketplace carry the same risk as any unknown reseller. In October 2026, former Mt. Gox chief Mark Karpelès said cheap Ledger units he ordered from sellers Ledger had not approved, one of them through Amazon Japan, came with hidden implants.
If the box is sealed and the shrink wrap looks perfect, is the device safe?
Not necessarily. Shrink wrap can be redone, and the fake Ledger devices mailed to customers in 2021 arrived in convincing shrink-wrapped boxes. Check the seals, but rely on where you bought the device and on setting it up correctly.
Will the genuine check in the official app catch a tampered device?
It catches counterfeit security chips, but Ledger warns that a pass only proves the chip is real; a unit can still pass with extra circuitry, like a spy implant, hidden inside the case. That is why buying from a trusted source matters even when the check passes.
I already set up a wallet I'm unsure about. What should I do?
Stop adding funds. Buy a new device from the manufacturer's own store, create a fresh recovery phrase on it, and move your crypto to the new wallet. Never type the old phrase into a website or app, and contact the maker's support only through its official website.
Sources
- Check hardware integrity (opens in a new tab) — Ledger Support
- Where to buy a genuine Trezor hardware wallet (opens in a new tab) — Trezor Support
- Ledger Support situation update on the CryptoBilis investigation (October 10, 2026) (opens in a new tab) — Ledger Support on X
- Mark Karpelès on where he bought his implanted Ledger Nano X (October 10, 2026) (opens in a new tab) — Mark Karpelès on X
- Mark Karpelès on cheap Ledger units from unauthorized sellers (October 10, 2026) (opens in a new tab) — Mark Karpelès on X
- Criminals are mailing altered Ledger devices to steal cryptocurrency (opens in a new tab) — BleepingComputer
- Alert: Modified hardware wallets spotted in the wild (opens in a new tab) — Kraken Security Labs
- Review and analysis of fake Trezor cryptowallet (opens in a new tab) — Kaspersky
Updated October 10, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.