A good reason why we shouldn't buy wallet from third-parties

[Hamza2424]

Here is another good reason why people should avoid buying hardware wallet from third party sellers, if you aren't not buying from the company direct you are sleeping with fire on your roof top.

First it was ColdCard, we got through that already, and now it's Ledger, Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Allegedly though.

He is not just any random person selling Ledger. He is an authorized Ledger reseller serving Indonesia, Malaysia, and the Philippines.

That's why Ledger itself has named the guy and given the instructions. They must have found a pattern where funds were mostly lost from these places and those who reported it had bought from this reseller.

Although this seller could be a problem because he could make changes to the wallets before giving them to buyers, that's why we should buy directly and confirm the code if we can. We can run the manufacturer's authenticity check or keep the firmware updated, but people still lost their funds, and this time they have lost a lot.

[Nothingtodo]

Why not from a third party?
Suppose you are holding Bitcoin and you do not have control over the wallet of that Bitcoin. After holding it for a long time, your wallet is frozen. Or your wallet is hacked by a third party. So what do you say you got by holding your Bitcoin for a long time?
That is why those who want to hold it for a long time choose non-custodial wallets in their control system. So that the complete control of this wallet is controlled by the holder.

[EFS]

It was a Ledger authorized reseller, not just an ordinary 3rd party seller so that makes the situation even worse. I hope the affected users are compensated for their losses.

I see hardware wallets as nothing more than cute accessories. I received a Ledger wallet as a gift back then, but I never used it to store my money. Even if I think it's safe, a little paranoia is a good thing. There are other ways to store coins, so I don't really need to use that one.

[TastyChillySauce00]

It is not out of place for a company to give a trusted third party permission to distribute a product in an area they don't have access to. I think Cryptobilis has been offering such services for a long time in Southeast Asia. The story is developing, but there is an account that Cryptobilis changed ownership of early this year. I think users should be informed when there is a change in ownership of a company. Those who bought Ledger devices directly from the manufacturer might not be affected.

The issue is that there was no disclosure by the previous owner because they signed an NDA. That should have been a red flag that the new owner was up to something. The money they were offered to sell the company might have made them think it was worth compromising their integrity, but now they will probably face several lawsuits.

It would be worth knowing if Ledger and the other hardware wallet manufacturers were aware of the ownership change. They really should have been monitoring their authorized vendors more closely. You can’t just allow a company to keep selling your devices when somebody new takes over without vetting them first.

That should be illegal isn't it? not disclosing change of ownership as a company that sells hardware wallet, something that involves other people's lifesavings. I can see a big lawsuit not only from people who bought the wallet through that authorized reseller but also from Ledger themselves and I'm curious if Ledger knew about the change of ownership.

Knowing how sacred hardware wallet is, i'm still surprised the distribution pipeline is this loosely vetted. It may be possible that any hardware wallet even from other company which got distributed from reseller, may also have the same thing going on except the hacker didn't pull the trigger yet.

[Darker45]

It was a Ledger authorized reseller, not just an ordinary 3rd party seller so that makes the situation even worse. I hope the affected users are compensated for their losses.

Exactly! The advice has always been to either buy directly from the official store or from authorized resellers only. Here's an authorized reseller installing spy implants inside devices. Because Ledger authorized them, this also Ledger's full responsibility.

It's basically Ledger who told everybody to trust them. They themselves do. And now that funds are stolen, they should also be paying the damages.

By the way, my hunch is that this criminal operation started when ownership was fully transferred to somebody from China known as Jiaming.

And since this reseller is also an official reseller of Trezor, Tangem, Safepal, and several other hardware wallets, perhaps the urgent warning to move funds goes out to them as well.

[Gravitypull$]

So far, the two wallets with massive loss after the hack are both closed source wallets (coldcard and ledger). With these hack news around the corner recently, I think it's better for me to set up Electrum cold storage hardware wallet for maximum security because the set up will be done in a safe environment and with an airgapped device instead, of buying a hardware wallet that will move from one hand to another before getting to you. Imagine that, you bought a wallet to keep your coins safe and that same wallet lost your coins. You wasted your money, time and effort at the same time.

[wapwapwendy]

Here is another good reason why people should avoid buying hardware wallet from third party sellers, if you aren't not buying from the company direct you are sleeping with fire on your roof top.

https://talkimg.com/images/2026/10/09/UlipXP.jpg

https://x.com/Ledger_Support/status/2108551100613714002

First it was ColdCard, we got through that already, and now it's Ledger, Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Allegedly though.

Buying directly from the official store is the safest option for me. You never know if someone has tampered with the device or its packaging before selling it. Better to be careful when your BTC is on the line.

[Hyphen(-)]

First it was ColdCard, we got through that already, and now it's Ledger, Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Allegedly though.

The Lesger itself should know their suppliers since it is a wallet, so that they will be help responsible for such acts, but this is just a damage control in my own opinion because they knows their dealers since they need authorization before they sell out the wallets to people. If they feel they are not safe with their suppliers, they should find a better way to do it and stop blaming others for something they can control.

They don’t know the consequences of all these Bitcoin losses; we rely on wallets like them to keep our Bitcoin safe, if they are the ones failing, then centralized exchanges will have something to say because in this short peoplednof time, known of them got hacked.

[The Founding Titan]

Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Allegedly though.

Or maybe someone was able to gain access to those wallets while they were still with Cryptobilis, they are responsible for whatever happens to those wallets in their custody but that doesn't mean they were the perpetrators, all sales from then have been suspended and the issue should be properly investigated, if the tampering happened with Ledger themselves and all the blames goes to Cryptobilis then it's only a matter of time till another reseller gets blamed for the bitcoin theft.

[5W-KILO]

It seems these crypto companies don't care.
Every wallet resellers should be trusted by the hardware companies.

Or maybe the hardware wallet companies should be handling shipping themselves.
There are Asic miners who handles shipping themselves.

Every hardware wallet companies should start sending products themselves because of safety problems of losing funds like this.

[Doan9269]

I'm not even a fan of using a hardware wallet, and therefore I will not be one of those who depends on any third-party agent to secure one; I would rather depend on using a non-custodial wallet that I can easily use, like Electrum or a blue wallet.

Privacy is not something we can afford to risk because we don't know who might compromise the process along the way, even if this is not coming from the developers; as long as a third-party agent is involved, the search is subject to risk.

[tbct_mt2]

First it was ColdCard, we got through that already, and now it's Ledger, Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Coldcard and Ledger are both hardware wallets but their security incidents are different.

Coldcard incident is from the hardware wallet technically then user practice but initially it was from Coldcard.
Ledger incident is from its authorized reseller that is more scary. If people bought Ledger hardware wallets from an authorized reseller but still be scammed, it's very unacceptable.

Wallet manufacturers can not ask all customers including average Joes to do Check Integrity of Hardware Wallets.

[Luzin]

First it was ColdCard, we got through that already, and now it's Ledger, Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Allegedly though.

We are learning in this case, but it will indeed be very difficult to find someone who is truly honest in this industry. Ledger companies have certainly anticipated this in various ways, including authenticity checks. The Ledger wallet industry network cannot be separated from distributors, including third parties. Even when the company’s products are genuine and meet safety standards, crimes can still occur during transit, including counterfeiting and possibly the addition of skimming devices that do not change the physical appearance.

There is no clarity at this time, it seems Ledger is investigating this, and Cryptobilis is currently suspected of being a reseller selling Ledger. However, it turns out that the CEO of Cryptobilis has already made a statement that Cryptobilis changed ownership at the beginning of the year. This change was also not known to the public due to an agreement not to disclose the change publicly. This issue is also currently a hot topic in my local forum.

[m2017]

Here is another good reason why people should avoid buying hardware wallet from third party sellers, if you aren't not buying from the company direct you are sleeping with fire on your roof top.

The second option isn't great either. When buying the hardware wallet from the official manufacturer, you might encounter a different problem: a leak of the personal data (full name, shipping address, etc.) provided during the purchase - something that has actually happened repeatedly, including quite recently with Trezor (in September).

Buying a hardware wallet these days is starting to feel like a roulette: the ball (the loss of your funds) might land on "ending up with a counterfeit", "personal data leak" or "losing your assets due to a vulnerability".
 

First it was ColdCard, we got through that already, and now it's Ledger,

And yet, this is just the beginning of the line. There are quite a few other HW manufacturers whose turn hasn't come up yet.

Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

It is too early to say who is at fault, as that has not yet been determined. At the very least, Cryptobilis will face questions that it will have to answer.

Need to wait for an official response from Ledger following their investigation.

Of course, this incident is yet another blow to Ledger’s reputation, but in this case, if the initial assumptions prove correct, Ledger is not actually at fault (or is it?).

[KiaKia]

I've honestly think about this too many times in the past, buy massive amount of wallets from manufacturers and sell to be public after doing something to them and wait many years for Bitcoin holders to relax and trust the wallet even more.

Many will slowly DCA Iinto Bitcoin, 2 BTC will turn 20 BTC and on a good afternoon like this I will just pull the plug, it's a big goldmine, this always comes to mind, I am not surprised that this happened.

Earn holders trust and pull the plug lol, but another part of me is feeling like the banks are looking more trustworthy than hardware wallet, maybe this was the goal after all.

[SeriouslyGiveaway]

I've honestly think about this too many times in the past, buy massive amount of wallets from manufacturers and sell to be public after doing something to them and wait many years for Bitcoin holders to relax and trust the wallet even more.

It's like a long time preparation for scam and assume that is a true plan, hackers already imported those Ledger customers' wallets to their own devices, trace transaction and balance histories during a long time. They waited till a time that they see total bitcoin balance in those wallets is big enough, to pull the scam action.

It's somewhat similar
I've been hacked (Electrum 4.3.2). Hackers waited silently till a big transaction funding that wallet, then exploited it immediately.

[retreat]

The status of Cryptobilis can be checked on Ledger's official website:


https://shop.ledger.com/pages/resellers?continent=asia+%26+oceania&country=indonesia


Ledger's goal in making authorized sellers is to ensure that the devices purchased by users are genuinely authentic and to make shipping more affordable for users who want to own the product. In this case, Cryptobilis isn't just any third party - they are an authorized seller, which means they should be more trustworthy and reliable because of their status, as explained by Ledger in their article.



But the problem is that the authorized sellers are actually distributing products that seem 'modified,' and it causes losses to the users.

In fact, in their statement, Ledger said that they assess their authorized sellers and ensure that the devices received by users are in original, unaltered condition. Check out their statement here:

What is an authorised reseller?

Ledger works with a network of authorised resellers that are carefully vetted retail partners who source their Ledger products directly through Ledger's official distribution chain, ensuring every device reaches you in its original, unaltered condition.

https://support.ledger.com/article/Purchasing-from-an-authorised-reseller

So this situation is actually so ridiculous because in another statement, Ledger seemed to treat this seller like an ordinary seller, even though they are actually their "authorized seller", in which they said they had carefully assessed before making it their authorized seller.

[PrivacyG]

The second option isn't great either. When buying the hardware wallet from the official manufacturer, you might encounter a different problem: a leak of the personal data (full name, shipping address, etc.) provided during the purchase - something that has actually happened repeatedly, including quite recently with Trezor (in September).

You could purchase directly from Ledger using false personal information, but even then you would still have other risks.  It is not only like russian roulette, you pay for it!

[PremiumcryptoHub]

The point is that many investors are concerned after two hardware wallets Ledger and ColdCard were hacked this year because we think these wallets are the most secure for storing Bitcoin investments safely. Actually OP you should note that this Ledger company itself has hired resellers for marketing purposes and they have many resellers all over the world as you can see at this link.

https://shop.ledger.com/pages/resellers?srsltid=AU7gw4XDoS2muMI16jJjYF93Qd9K1d-VegTQs_uoZXTOKVC9UhHz86zt&continent=america&country=argentina

Anyway they already mentioned that people who bought and setup ledger from cryptobilis reseller in the last 90 days are affected but I think people who bought earlier may not be affected yet. You can even check out their recent update that an unauthorized hardware implant was found on the device of one of the affected users and they have ordered Cryptobilis to stop selling this hardware wallet out of concern for their customers.

[KiaKia]

From a Ledger authorised reseller? Ledger needs to take the blame and they should be responsible for this loss, this is not a third party situation it's directly from a reseller that Ledger team trusted.

This isn't about Ledger alone, think about every other crypto wallets that people purchased through this seller, I think the time to consider paper wallet style of generating Bitcoin wallet is here.