Buy a hardware wallet safely: how to spot a tampered device

Where to buy a hardware wallet, what to check on the package and the device, what Ledger's genuine check proves and what it cannot, and the return rules.

Key points

Buy from the maker or one of its official resellers. On marketplaces, buy only from the maker’s own storefront.
A device that comes with a recovery phrase or a PIN already set is a trap. Do not use it.
Ledger’s genuine check proves that the secure chip is real. It cannot find every change to the rest of the hardware, so where you buy still matters.

Where to buy

Ledger recommends buying from Ledger or its authorized resellers. On Amazon, it advises buying only from the official Ledger storefront or an authorized reseller, and checking that the seller’s name on the listing matches the official storefront for your country. It calls buying from unverified third-party sellers risky.

Avoid used devices and offers far below the usual price. A tampered device can look new.

What to check when it arrives

Check	What to do if it fails
The package looks opened, altered, or damaged	do not use the device; Ledger advises contacting its support at once
A recovery phrase or PIN is included	do not use it; Ledger says a genuine device “never comes with a recovery phrase or PIN code pre-configured”
The genuine check in the maker’s app fails	do not use the device, contact the maker

What the genuine check proves

During setup, Ledger’s app sends a challenge to the device, and its secure chip has to answer with a signature that the app checks against Ledger’s servers. That proves the device contains a genuine secure chip.

Ledger is clear about the limits: the check cannot detect changes to the hardware, such as a hidden implant, as long as the original secure chip is still there. It also cannot prove where the device has been on its way to you. That is why Ledger still recommends buying directly from it or its resellers.

Returns

The makers’ return rules differ. Ledger gives 14 days. BitBox takes back unused orders within 90 days of delivery, but a BitBox02 whose vacuum seal was opened counts as used. Decide before you open the package.

What you can do

Order from the maker’s website, typed in by hand, not from a link in an ad or an email.
Inspect the package before you open it, and take a photo of it for a possible complaint.
Throw away any recovery phrase that came in the box, and contact the maker.
Run the genuine check in the maker’s app before you set up the wallet.
Set the device up yourself as a new wallet. The guide Set up a hardware wallet step by step shows how.

Next step

The page Hardware wallets compared links to the makers’ own shops.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.