A good reason why we shouldn't buy wallet from third-parties

[Antotena]

Ledger is not the one who tampered the hardware that CryptoBilis is selling. And for the context of history, CryptoBilis has a new owner, as it was sold recently. And that's where the tampering happened when the new owner takes over. It is also said that the old owner should be held accountable, however, they don't have accessed to any of it as obviously they are hands off already.

As for buying, I do understand, with the Coldcard incident and now this one, we should really be very careful. We might go back to the old and traditional way of keeping our Bitcoin safes and no longer trust this 3rd party wallets.

Ledger are not responsible, it was the company distributor if we are been fair to them. For the past years, Ledger has been accused of been not dependable when it comes to wallet but this one is not their fault. They know very well that if they do this back door, they are going to be held responsible, not only that they are going to lose the company and the product they are doing. However, this is still going to affect their sale, people are not going to trust them again.

We need to start going the traditional way of airgap device. You can use one of your laptop and convert it to airgap wallet and it will serves you better than some hardware wallets that ar sold. Just get one, remove the internet connection card and keep it in your house with seed phrase properly backup and that's all. You don't need to be doing firmware update or worry anytime they say a wallet company is compromise.

[Sandra_hakeem]

The second option isn't great either. When buying the hardware wallet from the official manufacturer, you might encounter a different problem: a leak of the personal data (full name, shipping address, etc.) provided during the purchase - something that has actually happened repeatedly, including quite recently with Trezor (in September).

You could purchase directly from Ledger using false personal information, but even then you would still have other risks.  It is not only like russian roulette, you pay for it!

You are currently communicating with someone who was a direct seller and participated in the sale of these wallets with or without a referral link (I don't know), but with bonuses that people were very interested in. Therefore, we could better learn about all the risks that buyers could expect from such sellers or agents

That's quite interesting. "We could better learn about all the risk involved from the buyer's end"--- permit me to ask, does any retailer know the level of risk involved in each of these wallets? What I mean is; aside from the third-party risk (that a seller might temper with, and inject the wallet-drainer bugs or private keys stealers before each sale), could there also be a company-to-consumer risk?

I'm curious because the case of the Asian retailer had nothing to do with the source, but the seller himself.

~because everything that happens behind the scene is most often of interest to those who are in this environment.😉
https://bitcointalk.org/index.php?topic=5049582.0

C'mon old lady, you've said a lot but I'm trying not to relate it to the aforementioned user. 

[MusaMohamed]

That's quite interesting. "We could better learn about all the risk involved from the buyer's end"--- permit me to ask, does any retailer know the level of risk involved in each of these wallets? What I mean is; aside from the third-party risk (that a seller might temper with, and inject the wallet-drainer bugs or private keys stealers before each sale), could there also be a company-to-consumer risk?

I'm curious because the case of the Asian retailer had nothing to do with the source, but the seller himself.

It can be from the reseller or customers of that reseller, who bought hardware wallets then returned wallets to resellers while resellers restocked such products. Next buyers will have more risk of becoming victims of attackers.

We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products.

CryptoBilis could possibly do this scam by themselves or they were trapped by some customers who very well planned this scam attacks.

[Sandra_hakeem]

That's quite interesting. "We could better learn about all the risk involved from the buyer's end"--- permit me to ask, does any retailer know the level of risk involved in each of these wallets? What I mean is; aside from the third-party risk (that a seller might temper with, and inject the wallet-drainer bugs or private keys stealers before each sale), could there also be a company-to-consumer risk?

I'm curious because the case of the Asian retailer had nothing to do with the source, but the seller himself.

It can be from the reseller or customers of that reseller, who bought hardware wallets then returned wallets to resellers while resellers restocked such products. Next buyers will have more risk of becoming victims of attackers.

Why should a device that's supposedly going to confide private keys be placed on a return policy? Are we pretending to not know the risk involved or we just blindly want to trust every user? The moment a package leaves the seller and reaches the recipients address, unless it was tampered by the delivery agents, any kind of malfunctioning whatsoever doesn't call for a refund. Let's all treat those devices as perishable goods--- the more people it gets to, the riskier it becomes.

I learned different rules apply to this; like once the seal is broken, the return policy doesn't cover that. There's also a window period to make a return. The security-sensitive nature of these wallets shouldn't permit anything like that.

[suzanne5223]

Here is another good reason why people should avoid buying hardware wallet from third party sellers, if you aren't not buying from the company direct you are sleeping with fire on your roof top.


https://x.com/Ledger_Support/status/2108551100613714002

First it was ColdCard, we got through that already, and now it's Ledger, Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Allegedly though.

Yes, there's great danger in buying a wallet through a third party, but people buying a hardware wallet from the company/manufacturer does not prevent them from sleeping with fire on your rooftop.
An example is the Coldcard wallet you mentioned, where the problem that led to the wallet hack came from the company.
What's important now is to be sure about the wallet firmware before getting the wallet directly from the company, or we should just download Electrum, verify it (to ensure it's authentic ), and back up the wallet in many secure offline locations.

[MisFoxie]

Ledger are not responsible, it was the company distributor if we are been fair to them. For the past years, Ledger has been accused of been not dependable when it comes to wallet but this one is not their fault. They know very well that if they do this back door, they are going to be held responsible, not only that they are going to lose the company and the product they are doing. However, this is still going to affect their sale, people are not going to trust them again.

Yes it is true that the Ledger company itself did not make any changes to their hardware wallets to steal users funds but still I will not trust any other hardware wallet because the company may make good products but if any such component is added during distribution or delivery through which they can steal funds then there is no benefit left in buying a HW.

I am happy that a few years ago a seller offered me some wallets that he had brought from another country and he was selling those wallets at a lower price. I think if I had bought those wallets I would be in exactly the same situation today. For some convenience I cannot throw away my hard earned money.

[Freeveto]

First it was ColdCard, we got through that already, and now it's Ledger, Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Allegedly though.

Both COLDCARD and ledger have something to say after the hack, there is always a blame from them. Ledger claimed it is from third party who sold the wallet, which to me is something they should be responsible for since they know their suppliers and trusted them with their wallets, if they compromise something, the ledger should be held responsible because there should be limit to what they can do, they shouldn’t have access to people’s wallets to go to the extent of having access to their private keys.

[r_victory]

Whenever possible, the best option is to buy directly from the company, from the manufacturer. I mentioned in another topic: the risk we run when buying products from resellers is great, especially when it comes to electronic products. I know it can be difficult, but there is a possibility that they are counterfeit as well as adulterated.

[PVequalNRT]

Hardware wallets are taking heavy hit in 2026 but someone with sense will know that this attacks aren't from the devices directly, ColdCard case was like that but that doesn't mean it's going to happen to other hardware wallets too.

The case of Ledger is not even close, the trusted seller is the problem, all I want Ledger to do is go after this reseller very hard and make them pay, if they can get them they can get all affected Bitcoin back.

Let's say there are some vulnerability and weaknesses, after every detection what happens? I believe this is why they need to get all the coins back to calm the holder and trusted hardware wallet users.

There are attacks from different places, the hardware wallets hack are popular because they are reported to be vulnerable which beat the essence of Hardware wallet. If the only way to be self custody are getting attack, then the centralized custody will be worse when they happened.

The Bitget exchange that recently loss different tokens is more than the amount stolen from hardware wallets combine and this is only one exchange. There are many more exchanges including Defi that were hack and exploited this year. The blockstream Bitcoin are yet to be returned by the white hackers, all of this happens within this year.

[arwin100]

Whenever possible, the best option is to buy directly from the company, from the manufacturer. I mentioned in another topic: the risk we run when buying products from resellers is great, especially when it comes to electronic products. I know it can be difficult, but there is a possibility that they are counterfeit as well as adulterated.

Doing such thing will help them avoid to buy those compromised wallets, just like that incident happened on Cryptobilis.

Now that they have seen its possible for third party seller to do tampering of wallets, that means their buyer is not safe and better leave that idea about buying their wallets with them.

Many people suggest about official sources and actually I agree with them, since this is how they can assure that devices they bough is safe. Then not been passed on risky hands of some online resellers.

[Zaka1221]

Yes, there's great danger in buying a wallet through a third party, but people buying a hardware wallet from the company/manufacturer does not prevent them from sleeping with fire on your rooftop.
An example is the Coldcard wallet you mentioned, where the problem that led to the wallet hack came from the company.
What's important now is to be sure about the wallet firmware before getting the wallet directly from the company, or we should just download Electrum, verify it (to ensure it's authentic ), and back up the wallet in many secure offline locations.

Technology is bringing many positive things with great features, but it's also having stress and issues, which are now growing in the last few years because security is one of the biggest threats. To them, hardware wallets were introduced for having better security and easy use, but recent hacks and big losses bring huge concerns; now people are not confident about their use, especially since having third parties is causing more troubles.

After this concern, people are surely feeling not good, but hopefully things will be improved, but third parties will always be under scrutiny because things have never been ideal to have them in this, but many things without them are also not possible, so hopefully this will also have something.

[Hazink]

Both COLDCARD and ledger have something to say after the hack, there is always a blame from them. Ledger claimed it is from third party who sold the wallet, which to me is something they should be responsible for since they know their suppliers and trusted them with their wallets, if they compromise something, the ledger should be held responsible because there should be limit to what they can do, they shouldn’t have access to people’s wallets to go to the extent of having access to their private keys.

That's not an intentional act. They know their supplier, and they are in contract with them, which even after that company changed ownership, that's not supposed to be a problem, so I can't put blame on them heart of people are just corrupt once money is involved they can betray, as for cold card you blame them because they use weak entropy for their wallet which is understandable but on the other hand hackers are the bigger people to blame here, we should just be hopeful they don't find a loophole on what we use and trust.

[Cookdata]

Whenever possible, the best option is to buy directly from the company, from the manufacturer. I mentioned in another topic: the risk we run when buying products from resellers is great, especially when it comes to electronic products. I know it can be difficult, but there is a possibility that they are counterfeit as well as adulterated.

What we are saying is, what if Ledger is responsible for this too? Honestly they have no reason to want to try this heist, but you never can tell. People do the least worst things you expect from them. What if the wallets were compromised within Ledger company by some engineers and some factory workers before it was shipped to distributors and now they can't even point fingers to who did it because there is no evidence to point fingers, they are just trying to save their asses.

If only everyone can go into a hardware shop and buy directly from them to avoid distributors, it will be cool than relying on other distributors. I don't know what tempered proof ways Ledger is going to take from hence forth, this is going to be a very difficult one and to restore the trust that is broken from people that trusted them.

[Just Say]

Hardware wallets are taking heavy hit in 2026 but someone with sense will know that this attacks aren't from the devices directly, ColdCard case was like that but that doesn't mean it's going to happen to other hardware wallets too.

The case of Ledger is not even close, the trusted seller is the problem, all I want Ledger to do is go after this reseller very hard and make them pay, if they can get them they can get all affected Bitcoin back.

Let's say there are some vulnerability and weaknesses, after every detection what happens? I believe this is why they need to get all the coins back to calm the holder and trusted hardware wallet users.

The case of Ledger incident with CryptoBillis is scary enough to push people away from hardware wallets because from now many people feel like they can not trust any hardware wallet resellers - authorized ones.

It's easy to don't trust hardware wallet sellers that are not authorized by a hardware wallet manufacturer but if even authorized ones can scam,
If it is not safe with Ledger, will it be safe with other hardware wallets?

The phenomenon of Cryptobilis along with Ledger Hardware Wallets are driving people away from hardware devices as they cannot trust any resellers, along with Cryptobilis, mediamarkt resellers selling Ledger devices as are you may have seen also not trusted as unauthorized spy chips and hardware implants have been found in the products they sell.

In fact many customers have lost their money due to these flaws in their wallets but I'm surprised that still they continue to sell these products,Ledger Hardware Wallet claimed that MediaMarkt had stopped selling all Ledger products in their stores and online platforms but their claims were false, because we noticed that a person from Germany went to another outlet in MediaMarkt to verify that they have stopped selling this device but they are still selling them.



https://x.com/0xJohannes_/status/2110029247238611203

how will people safely buy hardware wallets?

If someone wants to buy a hardware wallet, they should buy it from the official website or store and my opinion after purchasing, they should check it thoroughly to see if it is safe for holding Bitcoin.

[Adiljutt156]

There are attacks from different places, the hardware wallets hack are popular because they are reported to be vulnerable which beat the essence of Hardware wallet. If the only way to be self custody are getting attack, then the centralized custody will be worse when they happened.

The Bitget exchange that recently loss different tokens is more than the amount stolen from hardware wallets combine and this is only one exchange. There are many more exchanges including Defi that were hack and exploited this year. The blockstream Bitcoin are yet to be returned by the white hackers, all of this happens within this year.

There is too much chaos around crypto lovers because life is not easy even if they are doing enough for security, but still it's going to be more problematic just having a hardware wallet. It is not the end of the worst things because recently many attacks through phishing links and manufacturing faults are also new concerns because these are case-sensitive, but things are not going on level for keeping everything as it's needed.

Recent big attacks on hardware wallets increase security concerns, but things are surely going to have development because it always needs time; in case of failure, they are going to lose enough customers, and it's never been good for their business prospects.

[Churchillvv]

Here is another good reason why people should avoid buying hardware wallet from third party sellers, if you aren't not buying from the company direct you are sleeping with fire on your roof top.

I used to say that your wallet security depends on you, what you do and how you do it but recently I’ve been proven otherwise, your wallet security is not longer your personal duty only but the entirety of users and community duties since the companies are vulnerable to and extent.

Buying from a third party is not really a good thing to do but what’s the guarantee that if you buy directly from the companies website or direct from them that you wouldn’t have to go through same fate as others? That is nothing to write about because even people who got their hardware wallets directly are in same panic.

Cold wallet on Airgapped devices are the only thing left to be brutally decrypted or hacked once that is done there is absolutely no place to run to and that’s my fear.

[Rgram]

https://x.com/Ledger_Support/status/2108551100613714002

First it was ColdCard, we got through that already, and now it's Ledger, Cryptobilis or whatever it's called needs to be arrested, it's possible that this seller tampered with every Ledger purchased from him or them.

Allegedly though.

The ColdCard case is very different from this as, that did follow the pathway to seed generation and hacks which is rather uncommon but in this case, it’s a breach of trust between a particular vendor, the company and customer.

For the fact that, this incident is arising from a particular vendor, it’s very likely that the ledger wallets have being tampered which is the more reason why, when trying to remain secure in this space, you’ve got to follow certain rules to the letter. Always ensuring you get to the source for your purchases and downloads.

[lombok]

Here is another good reason why people should avoid buying hardware wallet from third party sellers, if you aren't not buying from the company direct you are sleeping with fire on your roof top.

I used to say that your wallet security depends on you, what you do and how you do it but recently I’ve been proven otherwise, your wallet security is not longer your personal duty only but the entirety of users and community duties since the companies are vulnerable to and extent.

Buying from a third party is not really a good thing to do but what’s the guarantee that if you buy directly from the companies website or direct from them that you wouldn’t have to go through same fate as others? That is nothing to write about because even people who got their hardware wallets directly are in same panic.

Cold wallet on Airgapped devices are the only thing left to be brutally decrypted or hacked once that is done there is absolutely no place to run to and that’s my fear.

Hardware manufacturing supply chain concerns are indeed legitimate as the safety of factory shipments still remains prone to massive hacking. Protection of digital assets is finally becoming common issue, one that involves the honor of vendors, open source communities, and auditors all around the world.

Standalone device that does not use any internet connection can also become an object for a physical attack through the exploitation of microarchitecture weaknesses and manipulation of internal parts. The fear becomes apparent as the ultimate stronghold of cryptography starts becoming vulnerable to brute force computer assaults.

[suzanne5223]

Yes, there's great danger in buying a wallet through a third party, but people buying a hardware wallet from the company/manufacturer does not prevent them from sleeping with fire on your rooftop.
An example is the Coldcard wallet you mentioned, where the problem that led to the wallet hack came from the company.
What's important now is to be sure about the wallet firmware before getting the wallet directly from the company, or we should just download Electrum, verify it (to ensure it's authentic ), and back up the wallet in many secure offline locations.

Technology is bringing many positive things with great features, but it's also having stress and issues, which are now growing in the last few years because security is one of the biggest threats. To them, hardware wallets were introduced for having better security and easy use, but recent hacks and big losses bring huge concerns; now people are not confident about their use, especially since having third parties is causing more troubles.

After this concern, people are surely feeling not good, but hopefully things will be improved, but third parties will always be under scrutiny because things have never been ideal to have them in this, but many things without them are also not possible, so hopefully this will also have something.

The advancement of technology was meant to prevent stress and issues, but when technology gives stress and issues instead, then it's a failure.
Therefore, I believe the security issues happening around hardware wallets have gotten a lot of people's attention, and the confidence of many will eventually take a hit due to hardware wallets, which were supposed to make self-custody simpler and safer are failing both from manufacturers and third-party sellers.
Soon, a lot of Bitcoiners will go back to using a properly verified air-gapped Electrum wallet setup and others with good offline backups if this issue continues.

[batang_bitcoin]

Whenever possible, the best option is to buy directly from the company, from the manufacturer. I mentioned in another topic: the risk we run when buying products from resellers is great, especially when it comes to electronic products. I know it can be difficult, but there is a possibility that they are counterfeit as well as adulterated.

Buying on the reseller is conditional because it saves time but, this gives a lot of skepticism right now why we should purchase on them. The impression that the stock they have might have been tampered. There's already the trust issue for all of the resellers, it's sad on their end and sales might drop a lot but they need to bear with the consequence of their parent company, Ledger for being too soft done by the former ceo of cryptosbilis.