The safest place to buy a hardware wallet is the manufacturer's own store, shipped straight to your door, and the next best option is a reseller that appears on the manufacturer's published list, bought from that reseller directly. That was the standard advice before 9 October and it still holds; what the Ledger reseller case changed is how much weight the word "authorized" can carry on its own. If you're working out where to buy a hardware wallet for the first time, the question to ask is how many hands touched the box before yours, and what you can still check once it lands on your table.
What happened with the Ledger reseller
On 9 October Ledger asked CryptoBilis, an official Ledger reseller in Indonesia, Malaysia and the Philippines, to pause all sales and shipments while it looks into reports of drained wallets. According to The Block's report, Ledger told anyone who bought from that reseller in the previous 90 days not to set up an unused device, and to move funds to a new device with a new recovery phrase if they already had. Bitquery's on-chain investigation puts the losses at 92.9 million USD across 311 wallets, higher than the first estimates from independent researchers, and the cause hasn't been confirmed.
Ledger's position, as ForkLog reported it, is that its own systems weren't compromised and that it has no reports involving devices bought directly from Ledger. We make a competing wallet, so weigh our reading accordingly, and for the detail of what has and hasn't been established, our running summary of the investigation is kept separate from this guide.
The buying lesson doesn't wait on the final cause. A reseller list records that a manufacturer approved a business, which is useful information, and it says nothing about what happened to an individual box while that business held it, a gap that applies to every brand selling through partners.
Where to buy a hardware wallet: the three channels
Every route ends with a hardware wallet in your hands, and the difference between them is the number of businesses and warehouses it passes through on the way.
| Channel | Who handles the box | What the makers say |
|---|---|---|
| Manufacturer's store | The maker, a courier, you | Ledger and Trezor both name their shop first |
| Reseller on the maker's list | The maker, the reseller, a courier, you | Accepted by both, if you confirm the seller on the official list |
| Marketplace listing (Amazon and similar) | Depends on who the seller is | Acceptable only when the seller is the maker's storefront or a listed reseller |
Buying from the maker is the shortest chain, and both Ledger's buying guidance and Trezor's support page put it at the top. Shipping times and import costs can make it less convenient outside the maker's main markets, and that inconvenience is the main reason resellers exist.
When you do use a reseller, check its name on the maker's list (Ledger's, Trezor's) by typing the maker's address yourself rather than clicking an ad, because lookalike shop domains turn up often. The CryptoBilis case shows where this step stops helping, since that reseller was on the list, so treat a listing as a reason to shortlist a shop and keep the arrival checks below for every device.
Marketplaces need the most care, because the product page and the seller are two different things. Ledger warns that many unauthorized third-party resellers operate on Amazon and tells buyers to compare the "Sold by" field with its official list, while Trezor runs its own Amazon storefront and says devices bought there are most likely safe. A listing priced below the maker's store, shipped by an unrelated seller, or described as open-box or used is the one to skip, however glowing the reviews look.
What to check when the box arrives
Whatever the channel, a few checks catch the usual problems, and both makers publish them:
- The packaging. Trezor uses holographic seals over the connector on its current models, and Ledger says not to use a device if the package looks opened or altered.
- No recovery phrase in the box. A legitimate device never comes with a seed phrase already chosen for you, so a printed card or a filled-in sheet means you stop there and contact the maker.
- Nothing already set up. Ledger says not to use a device that arrives with a PIN set, and Trezor says not to use one that already has firmware installed, because its devices ship without it.
- The maker's check, run from the official app. Download the companion app from the official site or app store, then let it confirm the device during setup.
That last check has a limit worth knowing before you rely on it. Ledger's own guidance says its authenticity check can confirm that the secure element is authentic, but it can't detect every physical modification to the rest of the device, and the implant research we covered describes hardware added outside that chip. Arrival checks are reliable at spotting a used or clumsily opened device and much weaker against careful tampering, which is why the channel you buy from matters as much as the inspection afterwards.
If you already bought from a marketplace
Buying from a third-party seller doesn't by itself mean your device has been tampered with, and the losses reported this month have been tied to buyers from a single reseller. If the seller isn't on the maker's list and you haven't set the device up yet, the cautious move is to return it and buy from the source. If it's already holding funds, Ledger's advice to CryptoBilis buyers is a reasonable template: a new device bought directly, a newly generated recovery phrase, and the funds moved across once the new setup is complete. Never type an existing recovery phrase into a website, a chat or a support form to "check" it, because that is how phrases get stolen, and our guide for affected owners covers the rest of that situation.
Where Ryder fits
We sell the Ryder One from our store at ryder.id. The same buying rule applies to us as to anyone: if you find a Ryder One listed by another seller, treat it with the caution described above.
The Ryder One creates its keys inside its secure element during your setup, so a recovery phrase or code arriving in the box is a reason to stop and contact us. If you're comparing a first wallet, the Ryder One product page lists what's in the box and the current price (the Starter Combo was 149 USD when we checked on 11 October 2026). Whichever device you choose, the order that protects you most is the one placed with the company that made it.
Share: