Where can I buy a hardware wallet?

[harizen]

Someone told me that it’s best to buy a hardware wallet directly from a manufacturer to avoid getting a tampered product. Is that always true?

99.9% yes. They care for their reputation and they are in business for long so you will have an assurance that the product you will receive is genuine and untouched.

And if ever the 0.01% struck you although the odds are low, you can report it directly to the manufacturer for a heads-up.

How risky can buying from a reseller be?

I'm not saying that buying from resellers is totally risky but if for delivery time issues (I think that's the only difference between direct against resellers), don't mind it and instead head to the official store.

Have seen some issues about buying from resellers in some of our local crypto groups before so better be safe. And in some cases, resellers don't mind you after they make a sell. If you have any problem, you will be left alone.

[o_e_l_e_o]

I'm not saying that buying from resellers is totally risky but if for delivery time issues (I think that's the only difference between direct against resellers), don't mind it and instead head to the official store.

Have seen some issues about buying from resellers in some of our local crypto groups before so better be safe. And in some cases, resellers don't mind you after they make a sell. If you have any problem, you will be left alone.

There is much more to be concerned about when buying from a third party than delivery time and after sales customer support.

A large number of "hacks" from hardware wallets (if you can call them that), have been from people buying devices from third parties who have pre-initialized the device. The third party prints out an official looking "seed card" (perhaps even behind some scratch off paneling to make it look more genuine) and includes it in the box, while keeping a copy of the seed phrase for themselves. If the user doesn't know to reset the device and just uses it out the box, then all their coins are easily stolen.

There is also the concern about supply chain attacks. There were a number of fake Trezor One devices reporting to be circulating. As far as I am aware, there is no publicly revealed way to create a fake Trezor T or Ledger device which will still be usable with their software, but that doesn't mean one doesn't exist.

For the sake of saving a few bucks or saving a day or two in shipping, it is not worth risking all your funds. Just buy directly from the manufacturer.

[jerry0]

I would always say buy it directly from ledger.  I would be very skeptical from getting it on ebay/amazon.



But what i notice was when i checked amazon.com... the price is not only cheaper, but the seller seems be called ledger reseller.  But is that one hundred percent legit?  I read the last few reviews and some ppl said the ledger appears to be tampered with and opened and they returned it.  But what do they mean by official ledger seller or reseller?  Their location they put down is also France.  So it's not exactly from ledger themselves... but ledger sells it to them and they resell it?



The price they seem to charge is a bit like over 50 dollars only.  But how do you know they are legit?  Example what if someone buys it from them then do something to it and send it back to them?  Then they send it back to you?



Also i asked this before but there has been zero cases of someone using a ledger that has been really physically tampered with right?  Like they did something to the software to the point where even if you reset it once or twice and get a new seed... its compromised?  I see lot of ppl talk about not buying off ebay or amazon but has there been any case of a tampered ledger that is not that social engineering trick where they give you the seed and pin and things like that?  Since that is like a trick... that isn't like compromised.



The more i think about it, is it one hundred percent safe even if someone gives or sells you a used nano ledger because a reset should automatically wipe it clean?  I just haven't heard any cases of a real tampered ledger.  Like all i hear is as long as you reset the device, you are fine. 

[bob123]

~snip~

It's not like you'd only need to solder a new chip onto the PCB to have it physically compromised.
You'd either need to find a vulnerability which allows you to (for example) flash malicious firmware onto the nano without it being rejected or additionally compromise the PC the hardware wallet is going to be used with.
That's way too much effort for someone selling them on a platform. It simply is not lucrative enough.

Other things would be easier to implement. A small antenna for example to trigger button presses from ~10-15 meters.
But this would require the attacker to be close enough to actually make use of it. Which is also very unlikely for a seller on amazon/ebay.

[Pmalek]

But what i notice was when i checked amazon.com... the price is not only cheaper, but the seller seems be called ledger reseller.  But is that one hundred percent legit?  I read the last few reviews and some ppl said the ledger appears to be tampered with and opened and they returned it.  But what do they mean by official ledger seller or reseller?  Their location they put down is also France.  So it's not exactly from ledger themselves... but ledger sells it to them and they resell it?

Don't trust what people on Amazon/Ebay and the likes are saying or writing on their profiles. Do the necessary checks yourself. Ledger has a retailers network that you can purchase your devices from. But you should only use the ones they have posted on their official site. If for some reason you can't or don't want to purchase from the official site, you can use one of the resellers.

Check out the list of their official retailers here:
https://shop.ledger.com/pages/retailers

[Husna QA]

Don't trust what people on Amazon/Ebay and the likes are saying or writing on their profiles. Do the necessary checks yourself. Ledger has a retailers network that you can purchase your devices from. But you should only use the ones they have posted on their official site. If for some reason you can't or don't want to purchase from the official site, you can use one of the resellers.

Check out the list of their official retailers here:
https://shop.ledger.com/pages/retailers

Unfortunately for me who lives in Indonesia, some Indonesian resellers, such as those listed on the ledger official retailers, are not actually in Indonesia, but in a nearby country. At least the advantage lies in the cost of delivery and also the estimated time to arrive, it can be cheaper and faster than ordering directly from France.

By the way, https://shop.ledger.com/pages/retailers also lists sales links from Official stores on Amazon in several countries.