A good reason why we shouldn't buy wallet from third-parties

[tabas]

So far, the two wallets with massive loss after the hack are both closed source wallets (coldcard and ledger). With these hack news around the corner recently, I think it's better for me to set up Electrum cold storage hardware wallet for maximum security because the set up will be done in a safe environment and with an airgapped device instead, of buying a hardware wallet that will move from one hand to another before getting to you. Imagine that, you bought a wallet to keep your coins safe and that same wallet lost your coins. You wasted your money, time and effort at the same time.

Yeah, nothing beats the old traditional way of keeping our funds since we've started. Go with electrum and just keep the bitcoin there that we have. While it has got some added security but with all of these hacking that we're witnessing, it is only creating more fear for the hardware wallets. But for the competitors, this is also a time for them to prove that they're worth more than the others and that's through proving how strong their security is and also going after their resellers by having routine checks.

[Dave1]

From a Ledger authorised reseller? Ledger needs to take the blame and they should be responsible for this loss, this is not a third party situation it's directly from a reseller that Ledger team trusted.

Ledger is not the one who tampered the hardware that CryptoBilis is selling. And for the context of history, CryptoBilis has a new owner, as it was sold recently. And that's where the tampering happened when the new owner takes over. It is also said that the old owner should be held accountable, however, they don't have accessed to any of it as obviously they are hands off already.

As for buying, I do understand, with the Coldcard incident and now this one, we should really be very careful. We might go back to the old and traditional way of keeping our Bitcoin safes and no longer trust this 3rd party wallets.

[X-ray]

So far, the two wallets with massive loss after the hack are both closed source wallets (coldcard and ledger). With these hack news around the corner recently, I think it's better for me to set up Electrum cold storage hardware wallet for maximum security because the set up will be done in a safe environment and with an airgapped device instead, of buying a hardware wallet that will move from one hand to another before getting to you. Imagine that, you bought a wallet to keep your coins safe and that same wallet lost your coins. You wasted your money, time and effort at the same time.

Yeah, nothing beats the old traditional way of keeping our funds since we've started. Go with electrum and just keep the bitcoin there that we have. While it has got some added security but with all of these hacking that we're witnessing, it is only creating more fear for the hardware wallets. But for the competitors, this is also a time for them to prove that they're worth more than the others and that's through proving how strong their security is and also going after their resellers by having routine checks.

I wouldn't be too hasty to make that conclusion, a DIY airgapped cold wallet have its share of risk like supply chain attack too, but instead of getting reseller forging fake hardware wallet or implanting spywares, you got hackers deploying malicious code from the open source library software used by the DIY cold wallet devices.

If you want to use electrum with mini PC for example, you better vet it before using it and the fact that most mini PC comes from china with sketchy preloaded apps and you need to take off the wifis, bluetooth, and other thing that may potentially become an attack surface.

Hardware wallet with direct manufacturer shipping and open source software is still very safe.

[lovesmayfamilis]

The second option isn't great either. When buying the hardware wallet from the official manufacturer, you might encounter a different problem: a leak of the personal data (full name, shipping address, etc.) provided during the purchase - something that has actually happened repeatedly, including quite recently with Trezor (in September).

You could purchase directly from Ledger using false personal information, but even then you would still have other risks.  It is not only like russian roulette, you pay for it!

You are currently communicating with someone who was a direct seller and participated in the sale of these wallets with or without a referral link (I don't know), but with bonuses that people were very interested in. Therefore, we could better learn about all the risks that buyers could expect from such sellers or agents, because everything that happens behind the scene is most often of interest to those who are in this environment.😉
https://bitcointalk.org/index.php?topic=5049582.0

[knowngunman]

First it was ColdCard, we got through that already, and now it's Ledger, Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Allegedly though.

People that were affected by the ColdCard incident haven't gone through it.

There is a way to check if your device is genuine or not but I believe many people don't bother to go through that process but this is not the right time to discuss that. We can not call for Cryptobilis arrest now because nothing has been found against him yet. Until the ongoing investigation is concluded, nothing can be done now other getting our fingers crossed.

Let not forget that he's an approved reseller of Ledger which means ledger trusted him. Of course, they did due diligence before approving him. So until something is proven, we can only be observing.

[PERtua]

The key takeaway is that not taking action to remove supply chain risks does not remove the risk as an authorized reseller. But the direct purchase from the manufacturer cannot guarantee users against all types of attacks. The recovery phrase should only be provided by the owner and the wallet initialized on the hardware wallet. Never use a Recovery Phrase if it has been prewritten on the device. The actual security check isn't in the area you purchased the wallet. But if you have control on the entire setup process.

[YOSHIE]

Here is another good reason why people should avoid buying hardware wallet from third party sellers, if you aren't not buying from the company direct you are sleeping with fire on your roof top.

This time I have to agree with your opinion, if we don't want all the Bitcoin assets we have to not be lost/hacked, never buy a Bitcoin wallet from any party, let alone be tempted by cheap prices or buy at retailers.
Buy a Bitcoin wallet directly from an official manufacturer.

A bad case of buying a Bitcoin wallet once happened to my friend, he bought a wallet where he bought Ledger or Trezor two at a time, when my friend connected the wallet to the computer, When my friend sent the private key and seed phrase, all the Bitcoin assets he owned were lost, fortunately the Bitcoin assets he had were not much, only a few dollars.

When he investigated the Bitcoin wallet he bought, it turned out that the wallet had been modified to contain a dangerous chip and several components had been modified internally, after I saw this topic I just remembered how dangerous it is when we buy a Bitcoin wallet with a third person, this might be a real warning for Bitcoin users all over the world, be alert and careful when buying a Bitcoin wallet.

[uchegod-21]

Yea, it is never adviceable buying wallets directly from third parties especially because of the risks of compromise. However, this case here is not about third parties. It is still about dealing with the manufacturer directly although through one of their suppliers.

Even though the supplier may not be considered a third party, it is still very risky for a wallet to pass through any other person before it reaches the buyer. The manufacturer of ledger wallet will have to take responsibility for this loss. I am believing that one of their actions towards recovering the amount lost is by investigating the supplier to confirm if they had a hand in this since lots of fingers are already pointing at them.

Report also has it that cryptobilis was recently bought. Ledger had the duty to discontinue any relationship with the new management of Cryptobilis until they are certain the new management of the supplier meet the criteria to do business with them. I guess that part was ignored. This is the reason why ledger will also take full responsibility for these compromise, so when choosing suppliers later in the future, they will screen them properly.

[letteredhub]

3rd party?
Well, the company itself hire distributors and resellers for marketing purposes, meaning they are also ones who take the risk just to promote their products.

This how modern manufacturing companies functions, they need distributors to get their products to reaching far locations without them having to expend so much cost themselves for provision of stores and warehouses for the storages of the products since that's a responsibility of the distributor in the partnering contract with them.

In this case I can't actually blame the HW company for the alleged unprofessional actions of their third party sellers.

Even if you buy them directly from the company, you are still using a 3rd party wallet, which is created by them.
Meaning having a wallet from them, even directly from the company you trust, and all of your funds to them.

It's safer buying directly from the company than from anyone else. Except you producing your own HW wallet otherwise you have no choice but just to ensure you're using a wallet from a credible company.

[Sonia_123]

3rd party?
Well, the company itself hire distributors and resellers for marketing purposes,

I agree, it is difficult to boycott distributors and resellers completely because the company actually approves some of these vendors for sales. You could buy from an approved vendor and still have an issue, and others buy from vendors that are not even approved and not have an issue. You can never really know at times, so I say the thing is trying to help yourself by doing research on any vendor you want to purchase a wallet from if you cannot buy directly from the company, check reviews about them from any possible source before making any purchase.

Even if your are buying from resellers or vendors it should be from a genuine and reliable source that can be held responsible if anything goes wrong at any point in time.

We have some trusted vendors and if you know that you are not satisfied with what you feel or seeing it is better you don't purchase from them but rather go straight to the manufacturer to buy by visiting the website or any means of contact after purchasing, confirm the seal if not already broken because for authenticity and originality you are to break the seal yourself, in that way you can be sure of what you bought and then generate your new offline recovery phrase by yourself and not any other one.
Getting directly remains the safest and trustworthy.

[Italian Panic]

And what would a reputable reseller look like? Companies often choose certain resellers without checking whether they undergo audits or even asking if they do. I, too, have come to believe that it’s not a good idea to choose third party hardware wallets and certainly not from resellers. It’s much better to rely on established desktop wallets, which, when installed with the proper precautions, guarantee excellent levels of security; the rest is just commercial hype.

[tabas]

Yeah, nothing beats the old traditional way of keeping our funds since we've started. Go with electrum and just keep the bitcoin there that we have. While it has got some added security but with all of these hacking that we're witnessing, it is only creating more fear for the hardware wallets. But for the competitors, this is also a time for them to prove that they're worth more than the others and that's through proving how strong their security is and also going after their resellers by having routine checks.

I wouldn't be too hasty to make that conclusion, a DIY airgapped cold wallet have its share of risk like supply chain attack too, but instead of getting reseller forging fake hardware wallet or implanting spywares, you got hackers deploying malicious code from the open source library software used by the DIY cold wallet devices.

If you want to use electrum with mini PC for example, you better vet it before using it and the fact that most mini PC comes from china with sketchy preloaded apps and you need to take off the wifis, bluetooth, and other thing that may potentially become an attack surface.

We can all agree that all of it has risk that they share with but some of it can have the minimal ones.

Hardware wallet with direct manufacturer shipping and open source software is still very safe.

I agree on this but, there's also a risk with it when there are collaborated actions being done that includes the couriers and sorting areas. We'll never know how safe it is from there although it gives more confidence to do the purchase directly from the manufacturer.

[shinratensei_]

You don't even entrust other people to carry your phone or your debit card, trusting third party to sell you hardware wallet which sole purpose is to hold money and can be tampered with is wilder. For sure, the first thing in mind when someone is buying a hardware wallet is to hold big amount of money otherwise they'd be using desktop wallet.

I hope after this people understand why "don't trust, but veryify" thing exist. The trust-based system is full of loophole because it's based on trusting other human and human is full of contradiction and greed.

[Jerrycrypto2024]

But the problem is that the reseller isn't just any reseller, they are an official authorized reseller for Ledger in Malaysia and Indonesia. People should be able to get more trustworthy and quality products since they are authorized sellers of Ledger. But unfortunately, people ended up losing their assets because of this product. Ledger and Cryptobilis should take responsibility for this mess.

I will concord that every company have their dealer who they approve to be marketing their products it's their duty to know them very well having information like this, the producer need hold them responsible for the breached of their products because they are the one entrusted selling to customers. But buying wallet from third party is dangerous naturally is like creating your bank account with road side personnel you know nothing about which can denial your transaction at any given time, the world and it's system is becoming more on high gambling that many will not know the direction to go either who to trust, as everything is having one or two risk that people will not like to take such adventure.

[Somegory]

Hardware wallets are taking heavy hit in 2026 but someone with sense will know that this attacks aren't from the devices directly, ColdCard case was like that but that doesn't mean it's going to happen to other hardware wallets too.

The case of Ledger is not even close, the trusted seller is the problem, all I want Ledger to do is go after this reseller very hard and make them pay, if they can get them they can get all affected Bitcoin back.

Let's say there are some vulnerability and weaknesses, after every detection what happens? I believe this is why they need to get all the coins back to calm the holder and trusted hardware wallet users.

[SilverCryptoBullet]

Hardware wallets are taking heavy hit in 2026 but someone with sense will know that this attacks aren't from the devices directly, ColdCard case was like that but that doesn't mean it's going to happen to other hardware wallets too.

Coldcard incident is from the wallet source code, the firmware but not from authorized resellers (vendors).
Ledger incident is from one authorize reseller (vendor) but there are possible more vendors like CryptoBillis with Ledger wallet delivery, it's quite scary.

Coldcard and Ledger incidents are very different with each other.

The case of Ledger is not even close, the trusted seller is the problem, all I want Ledger to do is go after this reseller very hard and make them pay, if they can get them they can get all affected Bitcoin back.

Let's say there are some vulnerability and weaknesses, after every detection what happens? I believe this is why they need to get all the coins back to calm the holder and trusted hardware wallet users.

The case of Ledger incident with CryptoBillis is scary enough to push people away from hardware wallets because from now many people feel like they can not trust any hardware wallet resellers - authorized ones.

It's easy to don't trust hardware wallet sellers that are not authorized by a hardware wallet manufacturer but if even authorized ones can scam, how will people safely buy hardware wallets?
If it is not safe with Ledger, will it be safe with other hardware wallets?

[Sammye3]

3rd party?
Well, the company itself hire distributors and resellers for marketing purposes,

I agree, it is difficult to boycott distributors and resellers completely because the company actually approves some of these vendors for sales. You could buy from an approved vendor and still have an issue, and others buy from vendors that are not even approved and not have an issue. You can never really know at times, so I say the thing is trying to help yourself by doing research on any vendor you want to purchase a wallet from if you cannot buy directly from the company, check reviews about them from any possible source before making any purchase.

If the company approves the vendors and there are some sort of issues afterwards, there should be a form of compensation and accountability for such compromise. Additionally, the supply-chain monitoring, reseller ownership changes, product inspection and consumer protection should be properly investigated too, because personal research alone cannot do all the work. For a reseller to be verified, that should be a form of guarantee already so it's not totally the fault of anyone buying.

For better security, it would be advisable not to totally assume that because a ledger passed a security test makes it safe, it would be wise to avoid entering pass phrase into a website or a system that offers support services because security should come first.

[Kelward]

But the problem is that the reseller isn't just any reseller, they are an official authorized reseller for Ledger in Malaysia and Indonesia. People should be able to get more trustworthy and quality products since they are authorized sellers of Ledger. But unfortunately, people ended up losing their assets because of this product. Ledger and Cryptobilis should take responsibility for this mess.

As far as this third party reseller is approved by Ledger we cannot blame the victims who were scammed with fake Ledger wallets because buying from an approved reseller of a product is as good as buying it from the main source. But it is very unfortunate that it turned out that fake products of Ledger were distributed through a supposedly trusted affiliate, I agree that Ledger should also take responsibility for this scam. We would wait for the conclusion of investigation to know the parties that are involved in this unfortunate event but I doubt that Ledger would jeopardize their reputation to be a part of it. Lesson to learn from this is that if you want to order for your hardware wallet you should priotize ordering directly from the source instead using third party affiliates.

[Aanuoluwatofunmi]

Another good reason why some of these manufacturing industries or let me see developers that make some of the hardware wallet should avoid the use of third party retailers is now made obvious, there should be a direct purchase from them rather than depending on any outlet to secure their product from, no one can be trusted and even the courier service and this is why the must be fully responsible for any challenges faced on their products used, however, I wouldn't suggest going for ledger wallet for any reason right from day one.

[RockBell]

Another good reason why some of these manufacturing industries or let me see developers that make some of the hardware wallet should avoid the use of third party retailers is now made obvious, there should be a direct purchase from them rather than depending on any outlet to secure their product from, no one can be trusted and even the courier service and this is why the must be fully responsible for any challenges faced on their products used, however, I wouldn't suggest going for ledger wallet for any reason right from day one.

To avoid all these kinds of things, because when you look at it, I feel like there are companies that you can do it directly, so there will be no need for a third party, because anything involving a third party will be a risk you have to be responsible for yourself, because I'm sure that there are links that, if anything should happen, they can be held responsible because anything that you are buying in this space, trust needs to be one of the up front because that is one way you can be safe because security matters and every form of third party should be avoided.