Where to buy a hardware wallet: manufacturer or reseller

When deciding where to buy a hardware wallet, check the seller before paying for your order. The device’s origin matters: you could receive a genuine wallet that has not been tampered with, or one an attacker has prepared to steal your funds.

In my years working with cryptocurrency, I have come across several cases of people losing funds after buying a wallet from an unverified seller. In this article, I explain how hardware wallets can be counterfeited or modified, how buying from the manufacturer compares with ordering from an authorized reseller, and how we check the origin of the devices we sell at Lwallet.

The risks of buying from an unverified seller

Marketplaces such as OLX and Telegram channels sometimes advertise hardware wallets at prices well below those on the manufacturer’s website. A seller may attribute the discount to a bulk purchase or a clearance sale, but that explanation tells you little about where the device came from. Even on Amazon, check the individual seller, since official stores and third-party sellers share the same platform.

A hardware wallet stores the private keys you use to control your cryptocurrency. If an attacker sets up the device before selling it and keeps a copy of its seed phrase, also called a recovery phrase, they can access the wallet created from that phrase. Attackers may also modify the device itself or supply a fake companion app.

Intact packaging and a familiar interface do not prove that a device is safe. Tampering may leave no obvious signs, and fake setup instructions can be particularly difficult to recognize if this is your first hardware wallet.

In 2021, a Ledger user posted photos of an unsolicited package containing a Ledger Nano X. It came with a letter supposedly from the company’s CEO, telling the recipient to replace their old wallet. The box looked genuine, but a USB flash drive had been soldered inside the device. The instructions directed the recipient to run software from that drive and enter their seed phrase. Entering the phrase into that software would have exposed it to the attackers; the recipient spotted the deception and did not connect the device.

Scammers also send physical letters bearing Ledger or Trezor logos and QR codes that lead to phishing websites. These letters may demand an urgent, supposedly mandatory authenticity check and threaten to cut off access to the wallet. Ledger warns about these campaigns: manufacturers and support staff do not ask you to share your seed phrase. Do not enter it on a website that such a letter directs you to.

With an unverified seller, it can be difficult to establish where a wallet came from or what happened to it before the sale. An authorized reseller buys from the manufacturer or an official distributor and can confirm the device’s origin. Compare any discount with the manufacturer’s current promotions and ask whether the device is new and covered by a warranty: a low price alone does not prove fraud, but it calls for an explanation.

What is a supply chain attack?

For a hardware wallet, a supply chain attack involves tampering with the device, its accessories or accompanying software before the buyer receives it. An attacker might interfere with the order in a warehouse, during shipping or through an intermediary.

If the seller is involved in the attack, they may:

• Set up the wallet in advance and keep its seed phrase, then repackage the device and sell it as new. This is known as pre-seeding.
• Add a component inside a genuine wallet, such as a chip or USB flash drive used to distribute malware.
• Include phishing instructions that direct the buyer to a fake website or tell them to install an unofficial app.

A seller may be unaware of tampering if they bought stock from an unverified supplier, or if devices were swapped or modified in transit. Whether an attacker can alter the firmware depends on the protections built into the particular model, while malicious instructions can be slipped into the package of a genuine device.

Supply chain attacks also affect software and services. In February 2025, attackers stole approximately $1.5 billion from the Bybit exchange after compromising a developer’s computer at Safe, a service for managing crypto assets, and altering the information displayed during transaction signing. The incident is described in Safe’s statement. In September of the same year, malicious code was introduced into popular npm packages, libraries used in JavaScript applications, and could replace recipient addresses when people used crypto wallets in their browsers. These incidents show how attackers exploit trust in a supplier or a piece of software their victim uses.

How we verify the origin of our wallets

At Lwallet, we operate as an authorized reseller and buy hardware wallets directly from manufacturers or official distributors. This allows us to trace each device’s route to our warehouse and confirm who supplied it.

If someone offers us a batch of wallets at a substantial discount but cannot establish their origin, we turn it down. We only sell devices whose route from the manufacturer to our warehouse we can trace, because a lower price does not justify the risk of buying wallets when we cannot establish who had access to them or whether they were tampered with.

Alongside the device’s origin, you need to check its authenticity. On the Ledger Nano X, Ledger Stax and other Ledger models, Genuine Check uses a cryptographic signature to verify the authenticity of the Secure Element, the device’s protected chip.

As Ledger explains, Genuine Check cannot detect every possible physical modification if the original Secure Element remains intact. Check where the device came from as well, and use the official Ledger Wallet app, downloaded through Ledger’s website: a fake app can display a “genuine” message without performing any check at all.

If you have not chosen a model yet, see our Ledger model comparison, which explains the differences in screens, connectivity and features for different uses.

Trezor ships new devices without firmware installed. If a newly purchased wallet already has firmware, the manufacturer recommends contacting support before continuing with setup. The bootloader checks the firmware’s digital signature at startup, while the Trezor Safe 3 and Safe 5 also use a Secure Element for hardware-based authenticity checks. Trezor’s firmware is open source, with the code available on GitHub.

Warranty coverage and support after purchase

Before buying, check the warranty period, the claims process and how to contact support. Knowing whom to contact makes it easier to resolve a manufacturing defect or get help if you have trouble setting up the wallet.

Warranty terms vary by manufacturer: Ledger’s limited warranty lasts one year, while Trezor specifies two years for consumers and one year for business customers. When buying from a reseller, confirm the terms that apply to your order and keep your proof of purchase.

We handle warranty claims for devices purchased from us in Ukraine, under the applicable warranty terms. If a problem arises, you can contact our support team or store. Getting that help from an unverified marketplace or Telegram seller can be difficult, especially without proof of purchase or clear service terms.

Where to buy a hardware wallet: comparing your options

Once you have verified the seller’s status, the choice between a manufacturer and an authorized reseller largely comes down to delivery, payment, support and how warranty claims are handled.

Buying directly from the manufacturer

Advantages: you order the device and get support directly from the manufacturer. New models may also appear on its website before they reach local stores.

Drawbacks: for a buyer in Ukraine, this usually means international shipping, payment in a foreign currency and support in English or another available language. Shipping costs and customs charges may be added to the price, and customs clearance can affect delivery times. If you need a warranty replacement, you will have to arrange with the manufacturer where and how to return the device.

Buying from an authorized reseller in Ukraine

Advantages: you can pay in Ukrainian hryvnias and have your order delivered within Ukraine. We advise on model selection and setup, provide support in Ukrainian and handle warranty claims through our store.

Drawbacks: the price may differ from the one shown on the manufacturer’s website, and the reseller may not stock every model in the manufacturer’s catalog. When comparing offers, consider the total cost of your order, including shipping and any additional charges.

For buyers in Ukraine, I recommend a local authorized reseller if you want support in Ukrainian and warranty service through a local store. Ordering directly from the manufacturer is also a reasonable option, particularly if the model you want is unavailable locally.

How to check the seller and your new wallet

Check the seller before paying. Once your order arrives, inspect the device and verify its authenticity before adding funds to the wallet.

Before you pay

• Verify the seller’s status on the official reseller list for Ledger, Trezor or the relevant manufacturer, and match the listed name and website to the store you are ordering from. A claim to be an “official partner” on the seller’s own website does not establish that it is authorized.
• Ask about warranty coverage and support: what proof of purchase you will receive, whom to contact if the device develops a fault and how warranty claims are handled.
• Ask why the price is heavily discounted, compare the offer with the manufacturer’s promotions and confirm that the device is new. If the seller cannot explain where the stock came from and the terms of the sale, buy elsewhere.

When your order arrives

• Inspect the packaging and device, comparing the appearance and placement of any security stickers or holograms with the manufacturer’s instructions. If your model uses them, they should be intact. If you see damage or signs of opening, pause setup and contact support.
• Make sure the wallet has not been set up for you: follow the manufacturer’s instructions during your first setup and generate your own seed phrase. If a preset phrase is included in the box or the seller supplies a preconfigured PIN, do not use the device to store funds.
• Verify the device’s authenticity using the manufacturer’s official app: Ledger Wallet for Ledger, or Trezor Suite for Trezor. If the check fails or you see a warning, stop setup and contact support.

Final considerations

When deciding where to buy a hardware wallet, compare delivery and after-sales service from the manufacturer and authorized resellers. Once it arrives, verify the device’s authenticity, set up your own wallet and store your seed phrase somewhere safe. Do not share it with the seller or support staff, or enter it on websites that ask you to “verify,” “update” or “migrate” your wallet.

If you would prefer to buy a wallet with delivery within Ukraine, warranty service and support in Ukrainian, contact us. We can help you choose and set up your device, and our technical support team is available during business hours.