How to buy a hardware wallet anonymously

[goaldigger]

Just make sure when you are buying that its sealed because Bestbuy accepts returns on pretty much anything and if someone bought it, tampered with it, and returned it you might be in trouble.

I would point out that for an attacker who is capable of tampering with a hardware wallet, bypassing its security mechanisms, flashing malicious code or replacing some internal chip with a malicious one, and still having it pass whatever verification process it has, then being able to reseal a package or forge a tamper-evident sticker is absolutely trivial and should not be relied on whatsoever.

Hackers always have their ways but so far ledger prove to be one of the secured wallet, just make sure you bought the original one. Anyway, you can just ask someone to buy for you if you are afraid of leaking your own information. Just like what I did when I just asked my friend to buy the wallet for me since we are grabbing the buy 1 take 1 option before at a more discounted price, you might also want to do this.

[1714685129]

1714685129

[1714685129]

1714685129

[1714685129]

1714685129

[1714685129]

1714685129

[o_e_l_e_o]

Hackers always have their ways but so far ledger prove to be one of the secured wallet, just make sure you bought the original one.

That's the point I'm making though. Relying on a package either being sealed or having tamper evident seals or stickers is not a good nor a reliable way to be sure that you have bought an authentic or original device. You can buy hundreds of shrink wrap bags for less than 10 bucks which you just heat up with something like a blow dryer to shrink and seal around your package. Tamper evident stickers are only marginally more tricky than this to fake.

Each hardware wallet should have its own processes for verifying its authenticity, such as firmware being signed by the manufacturers or cryptographic handshakes with their servers. Some, such as Ledger, also provide guides on opening your device and examining the hardware itself to ensure nothing has been added or modified.

[adaseb]

I’ll open it up if I find a guide somewhere and look around and compare. Honestly getting worried now. However has there been any tampered hardware wallets in the past?

I only heard of having tampered instruction manual where they tell the user to use a specific 24 word seed. The guide makes it seem like it’s for that specific device.

I also heard of some earlier hardware wallet where the passcode is easy to bypass but that requires having the physical HW at hand.

Getting second thoughts and I might actually return this and just use my old Electrum/MEW cold storage solutions.

[o_e_l_e_o]

I’ll open it up if I find a guide somewhere and look around and compare.

There is a guide on the Ledger website: https://support.ledger.com/hc/en-us/articles/4404382029329. I wouldn't be following any third party guides for something like this.

Honestly getting worried now. However has there been any tampered hardware wallets in the past?

Yes. See this thread for more details: https://bitcointalk.org/index.php?topic=5344317.0

Getting second thoughts and I might actually return this and just use my old Electrum/MEW cold storage solutions.

I prefer true cold storage over hardware wallets, if you have the technical knowledge required to set up and use such cold storage properly. But most people don't, and it is much easier to make a mistake with a self created cold storage solution over a hardware wallet. Given that you've bought from an official reseller, if you follow the guide on the Ledger website to confirm authenticity before you use the device, then you are as safe as can be using a hardware wallet. I'm just pointing out that the things that you think are a mark of safety - such as a sealed box - are meaningless compared to the things which are actually a mark of safety - such as cryptographic signing.

[adaseb]

I do use old school cold storage methods such as electrum with a cold storage computer and same with MEW with cold storage signing on an offline computer.

I reason I got the ledger was because crypto is evolving and if you want to get into Defi or NFT you need to use Metamask. And to use Metamask securely only method is by ledger. I am surprised you can’t create an Metamask wallet offline and sign transactions like you would with electrum.