Bitcoin Forum

Did anyone buy Ledger from their site and pay Bitcoin for it?
It scares me a bit because Bitcoin has no supervision.
Is there anyone who did it and everything was fine with him and he got the Ledger without problems?

Yes, I bought one with Bitcoin and I received it about 3 weeks later. You get a invoice for your purchase after you paid for it, so you get proof of your purchase. Just make sure you navigate to their official site and not some spoof site.

Good luck with your purchase and remember to pay the maximum fee to get the transaction confirmed in the shortest time possible. <I think they have a 15 min count down>  ::)

Be careful, some people said they found the wallet  adulterated !!!
I follow the channel of this youtuber Marco Casorio. He recommends buying directly in the store

https://www.youtube.com/watch?v=1m2yHtmbhp8

Yep. I chose Trezor a couple of years ago, but was recently going to get a Ledger because of the amount of different coins it holds until I heard about the tampering.

Great topic! Just the day after tomorrow I will buy. Now you have convinced me of the purchase! Thanks for the advice, we have in Belarus the price of the ledger is 130 dollars.

As long you are buying directly from the official site (https://www.ledgerwallet.com/ (https://www.ledgerwallet.com/)) it works smooth. I bought one myself (with btc).
You don't have to worry when paying with bitcoin.



Tampering?
You don't really have to fear of recieving a tampered device.
The nano s runs an integrity check at each start up. Additionally they have a guide published to open the nano s and look if it has been tampered with additional chips, etc..
You can read more about the anti-tampering method on their site he: https://www.ledger.fr/2015/03/27/how-to-protect-hardware-wallets-against-tampering/ (https://www.ledger.fr/2015/03/27/how-to-protect-hardware-wallets-against-tampering/)
An on how to check the integrity hardware-wise: https://ledger.zendesk.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S- (https://ledger.zendesk.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-)

i brought the ledger nano s from this site. this is official ledger nano s . https://www.ledgerwallet.com , i paid using my credit card. i think is safe way to get it. then shipped with in 3 days and i got the package with in a week. i ordered 2 device from that site. all working fine and i deposited all my btc,eth and erc 20 in it.i think you should follow it.pay using usd

We got ours a few months ago - purchased with Litecoin from the official store. Very fast transaction and there was a clear trail of evidence showing the purchase. The wallets arrived well ahead of schedule and in perfect working order. I hope that helps!

I want to buy Ledger Nano S how to do ?  ::) ::)

Better to buy ledger from the official site than buying in amazon or ebay

Its a must have and very cheap to buy in order to protect your investments. Just make sure that you buy it from the official website and never buy it used. There has been som sites that sold a copy which could cause you to loose alle your assets so just be sure that you get it from the official site and that the seal is not broken.

You can buy one with usd, euro or BTC on their official website  ;)

With litecoin? Or it was a typo? I also want to buy it with a Litecoin or with some other coin with small transaction cost, because Bitcoin transaction cost is too big. Is it really possible to buy it with Litecoin from the official site? How?

When you open a ledger nano s box it tells you that it is not security sealed, since all you have to do is reset it if it has been used before.  It appears that even if it has been used by someone else it would not be necessarily compromised, as long as it is reset before you use it.

hi everybody

I've just bought a nano s ledger wallet and I'm not having great success with it. I'm pretty sure its me and not the wallet.

i can't seem to get the userinterface onto the nano so it interacts on screen.

it does state the ledgerwallet needs to be downloaded onto the computer (which I've done) but i can't download it onto the nano this must be the reason why the interface doesn't seem to interact on the computer.

can i change the 24 word passphrase and reset it and start again?

How I bought mine last year. Took about 17 days to get to me in the states.  I wouldn't trust a reseller.  There was a chap on reddit who bought from a reseller and ended up losing his entire life savings.

https://news.bitcoin.com/mans-life-savings-stolen-from-hardware-wallet-supplied-by-a-reseller/

I also bought it directly from their official site with BTC without any problems. Delivery took 2 weeks after order.

I bought one some time ago and paid for it Bitcoin. Evertying was fine and no problem at all except the long delivery time. However, they often give you the information about the delivery time. Mıne was one month later and it took 2 weeks for delivery (I guess due to custom). Just make sure to keep an eye on url before buying your device. It is very imporant device for Cryptocurrency holders.

I tried a digital bitbox too, cheaper than ledger nano S

The manufacturer has a good price.

https://www.ledgerwallet.com/products/ledger-nano-s

Yes, I bought my ledger nano s with bitcoin and everything went smooth as a whistle.

Dont worry about it, these guys are as legit as it gets.

There are TWO components that you'll need to make the most of your Ledger Nano S.

Firstly, you want the Ledger Manager: https://chrome.google.com/webstore/detail/ledger-manager/beimhnaefocolcplfimocfiaiefpkgbf?hl=en

This is the software that lets to install and uninstall the individual coin "apps" onto he ledger device... as well as update the firmware etc. I suggest that you install this, open it up, then connect your ledger (unlock it using your PIN) and the manager app will detect your device. This will confirm that your device is working OK and is detected by the PC ok.

Then, close the Manager app, as you cant have the Manager and Wallet apps running at the same time.

Secondly, install the "Ledger Wallet Bitcoin": https://chrome.google.com/webstore/detail/ledger-wallet-bitcoin/kkdpmhnladdopljabkgpacgpliggeeaf?hl=en

Run that, connect the Ledger Nano S, unlock it with the PIN and then select the Bitcoin "app" on the Ledger device. The wallet app should detect you device and open up the Bitcoin wallet UI. It should prompt you to select "Bitcoin" or "Bitcoin Cash".

NOTE: You may need to disconnect and reconnect the Ledger from the PC, if it isnt detected after you had the Manager app open.


ps. In the future, you should really create your own topic rather than hijacking other topics ;)

SECURITY

Ledger Receive Address Attack

https://www.docdroid.net/Jug5LX3/ledger-receive-address-attack.pdf


Overview
Crypto wallets consist of a private key for spending funds, and a public key for receiving funds.
Modern Crypto clients usually create a new receive address after every transaction.
This is done to better protect the privacy of the user, by spreading his funds across multiple addresses,
rather than one.
Receive addresses are normally generated automatically and are transparent to the wallet owner.
The Attack
Ledger wallets generates the displayed receive address using JavaScript code running on the host
machine.
This means that a malware can simply replace the code responsible for generating the receive address
with its own address, causing all future deposits to be sent to the attacker.
Because receive addresses are consistently changing as part of the usual activity of the wallet, the user
has no trivial way (like recognizing his address) to verify the integrity of the receive address.
As far as he knows, the displayed receive address is his actual receive address.
What Makes This Even Worse
-  All the ledger wallet software is located in the AppData folder, meaning that even an
unprivileged malware can modify them (no need to gain administrative rights).
-  The ledger wallet doesn’t implement any integrity-check/anti-tampering to its source files,
meaning they can be modified by anyone.
-  All the malware needs to do is replace one line of code in the ledger software, this can be
achieved with less than 10 lines of python code.
-  New ledger users would typically send all their funds to the wallet once initialized.
If the machine was pre-infected, this first transaction may be compromised causing the user to
lose all of his funds.
-  The attack changes the receive address during its generation, causing even the automatically
generated QR to be updated to the attacker’s address. Meaning that both the string and QR
representations of the address are compromised.
Proof of Concept
Open the file:
C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User
Data\Default\Extensions\%EXTENSION_ID%\%EXTENSION_VERSION%\src\wallet\wallet.js
Replace the line:
return (_ref = this.wallet.cache) != null ? _ref.get(this.getCurrentPublicAddressPath()) : void 0;
With:
return “MY_MALICIOUS_ADDRESS”;
The next time you receive funds, all the funds will be sent to MY_MALICIOUS_ADDRESS.
Mitigation
Un undocumented feature, that isn’t even part of the official “Receiving BTC to your Ledger” article, can
in some cases help verify the integrity of the receive address.
On the bottom right part of the receive screen, a small monitor button exists. Pressing this button will
cause the receive address to show up on the hardware wallet’s screen.
This can be used to verify that the address is valid and has not been tampered.
Note that this process is not part of the default receive process, and is not enforced by the wallet.
A proper solution would be to enforce the user to validate the receive address before every receive
transaction, just like the wallet enforces the user to approve every send transaction.
Also, this undocumented feature only exists in the Bitcoin App.
The Ethereum App (and possibly other apps as well) has no mitigation, the user has no way to validate if
the receive address has been tampered.
Advice for Existing Ledger Customers
If you’re using the Bitcoin App – Before every receive transaction validate the integrity of the address
using the monitor button.
If you’re using the Ethereum App – Treat the ledger hardware wallet the same as any other software-
based wallet, and use it only on a Live CD operating system that is guaranteed to be malware-free. At
least until this issue receives some kind of fix.
Responsible Disclosure
Unfortunately, Ledger doesn’t have an organized vulnerability disclosure program.
Nonetheless we contacted the CEO and CTO of Ledger directly in order to privately disclose and fix the
issue. We’ve received a single reply, asking to hand over the attack details. Since then all our mails have
been ignored for 3 weeks, finally receiving an answer that they won’t issue any fix/change.
Timeline:
4, January, 2018 – First contact with general information.
4, January, 2018 – CTO of Ledger requested the full details of the vulnerability.
4, January, 2018 – Full Details were sent.
10, January, 2018 – We’ve requested an update, no response.
13, January, 2018 – Again, we’ve requested an update, not response.
27, January, 2018 – CTO of Ledger replies that no fix/change would be done (our recommendation to
enforce the user to validate the receive address has been rejected), but they will work on raising public
awareness so that users can protect themselves from such attacks.

http://cryptorus.info/ledger-addresses-man-in-the-middle-attack-that-threatens-millions-of-hardware-wallets/

I had also thought about buying such wallet. Yeah, it's really safe but it has one disadvantage - it depends on the website. What do you think about that, is it really worthy to buy this wallet?

I've never bought one. I think that those keys are for those who hold big ammounts of btc not like the normal people that holds less than 1 btc. When I get more btc I will buy one for sure!!

What do you mean it depends on the website? If you mean you have to use the "Ledger Wallet Bitcoin" chrome app, then that is not true. The Nano S is compatible with a lot of wallets like Electrum, Mycelium, MyEtherWallet etc. You are not limited to just using the Ledger wallet chrome apps.


Given that the device costs somewhere around US$100... If you have an amount of BTC worth more than this, then you should consider a hardware wallet. For instance, if you have 0.1 BTC... Granted with the recent decline in BTC value, 0.1 BTC is only worth around $800 but still... with Ledgers new pricing (including shipping) of €79 (~US$100), then you're "investing" 1/8th of your bitcoins in security.

How much do you value your BTC? $100 is a relatively small price to pay for peace of mind...

I just want to add, it is crucial to select the Bitcoin "app" on the Ledger device, otherwise it will not detect the wallet on the computer side. In the beginning, I plugged it in and then the screen just waited to detect the device. I thought that there was something wrong with the device, because it only seem to hang there.

It was only when I selected the Bitcoin wallet on the device that the software on the computer, detected the hardware wallet. This might be what is happening with him.

I have to say, the delivery of the device was pretty quick. < It was send from Paris in France >?

The Ledger Nano S is a good tool to hold your Bitcoin securely for sure. Paying with Bitcoin as an option is always good!

That sounds really bad. So much for security. What's the point of a hardware wallet if it is just as vulnerable as a software wallet?

A hardware wallet is much more secure than a software wallet (desktop wallet).

The current attack can't be prevented. This problem is tied to the OS.
The only thing which can be modified is what you see on your desktop. This can't be prevented without directly modifying the OS.

Ledger already has a 'fix' published. The recieving address has to be confirmed on the nano s.
Everything which appears on your nano s (confirming via pressing the button) is safe to use and you can be certain this address has been created by the nano s.

I purchased a nano s with bitcoin and had no issues at all.

Buying with BTC is seamless, just use the official site, it's all well integrated. Volatility on the other hand...

I bought 2 ledger nano s with Bitcoin. Get it after 4 weeks. Strongly recommend to buy it from the official site.  Paying with crypto is always good!

I am very happy with my Nano Ledger, even though I am not so happy with their latest software update - now it is more complex to log in the Ledger each time you have to and it takes more time. This security measure was not necessary at all, it was paranoia based vs reality based.

Does anyone know the price in Bitcoin?

Visit the official site (https://www.ledgerwallet.com/products/ledger-nano-s), click 'Add to cart' -> 'Checkout' -> Scroll down and choose your payment method BTC.
Price will be displayed.
To check the shipping costs, enter your deilvery address.

Do you mean on pin changed to random number?For me it is almost the same, you just need to pay attention when you pick number-as before it was always start with 5 and now it is just random.Maybe user can lost few seconds on that, but nothing more.I agree that this option makes sense only when using your device in public places and someone is targeting you because knows you have cryptocurrency.


In Ledger site price is set from 94.80 Euros + free shipping, and probably may vary in price because of VAT (value-added tax) which can be different in each country.So to get the exact price just go to Ledger site and add 1 device on your cart-at the end you will see final price in Euros.Just click on BTC as option for payment I you will get price in Bitcoin.

Also keep in mind that you might need to pay import duties on the device. I had to pay a large sum of money on top of the courier fees to take ownership of the device. You might be lucky if custom did not open your package, because some friends of mine had their package opened and inspected. They are now uncertain if the device was tampered with. <I doubt if custom officials have the expertise to pull off a "man in the middle" attack, but you never know if one of these guys are a Bitcoiner> ::)

 

I got my ledger without any problems directly from the website. Payed with Btc.

I want to know if the hardware wallet can be sent to purchasers any part of the globe as long as payment is confirmed? Or must one be resident in the country of the manufacturer's or vendors to be able to purchase. Am asking because I don't think there is a store where such is sold in the part of the world I come from.

I got mine through amazon. Great price.

Your best bet is to probably contact Ledger directly and ask them if they ship to your country... I don't live in France (where Ledgers are manufactured) and I was able to order one from the Ledger website and get it delivered to my country.

As long as your country is able to receive international shipments (was sent DHL from memory) and you're not breaking any import restrictions, I don't see why you couldn't get one...


Hope you took adequate protections to ensure you don't get scammed by a device that was pre-initialised... there have been several reports of people buying from resellers at "great prices" getting devices that already had a seed loaded on it. :-\

I have Ledger Nano S but a bought it from a friend. I don't know where is his source but I'am really satisfied with my Ledger. I put my Ripple and Ethereum there. If you will buy online, just make sure that it is the legit site for Ledger.

Yea, the team is based in Paris so that makes sense

What does the supervision anything to do with the ledger? Ledger is for security purposes of your wallet. And it is better to buy a ledger and ask for experts where they can buy a legitimate one. I think ledger is the best way to secure your crypto wallet and you should have no problems as long as you buy a legitimate one.

I would assume Amazon products are great, but if I were you, I would buy directly from the website. Not only it gives more credibility to the product, but also it reduces the middlemen, thus the minimum chance to do any defects to the product to steal product key (when you actually use it). I have read stories that buying from eBay is bad, but usually Amazon is better than eBay, but I would still go for the maximum safe method, that's buying directly from the website.

Ledger S on Amazon.com is sold by many vendors, but not by Amazon itself. Additionally, most of these vendors even send the product themselves, not via Amazon.
So I think in this case Amazon is not better than eBay

You should be careful and inspect a ledger when you receive it.  Unlike the advertising materials on ledger's website, the Nano S is NOT tamper proof.  Any number of exploits could be made to the packaging materials (https://news.bitcoin.com/mans-life-savings-stolen-from-hardware-wallet-supplied-by-a-reseller/ (https://news.bitcoin.com/mans-life-savings-stolen-from-hardware-wallet-supplied-by-a-reseller/)) or a daughter card could be inserted to inside the case, or malicious firmware could have been written to the device (https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/ (https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/)).  Fundamentally, these are not great devices...

You first example was simply social engineering... that's a fault with the user, not the device.

Have you seen the inside of the case? There is barely enough room for the "actual" board and components. Your chances of putting a "daughter card" in there are practically zero.

Your final example of the "malicious firmware" has already been patched by Ledger.

Fundamentally, they ARE good devices... as long as they're used in a proper manner and with proper consideration and precautions (ie. Only buy from Ledger direct or an authorised reseller, make sure YOU intialise the device, read the instructions and info on Ledger website etc)

But watch out when buying from any amazon marketplace. Better buy it directly from Ledger and be sure that the ledger has not been used before. Otherwise it could be manipulated and someone could steal your cryptos.

Yea, make sure the product is firstly by Ledger

and if needed, by directly from their store page on Amazon: https://www.amazon.com/stores/Ledger/Ledger/page/D665D2FA-1FBB-4A5F-953C-15AC875BC674

buy only genuine Ledger products
the list of genuine re-sellers is here, on Ledger official web site -> https://shop.ledger.com/pages/retailers
or just buy directly from Ledger web shop