Your device protects everything that you will put on it, so where you buy it matters. This guide is part of our guide to hardware wallets explained.

Why the supply chain matters

Attackers have sold wallets that were opened, altered or sent with a pre-written recovery phrase. Fake devices have even been mailed to customers whose details were leaked. A wallet from an unknown seller could be set up to steal from you. See pre-generated phrase scams.

Where to buy

SourceSafety
Maker's official websiteBest
Authorized reseller listed on the maker's siteGood
Official brand store on a large retailerFair, so check the seller
Marketplace third-party sellerRisky
Auction site or classified adAvoid
Second-hand from a friendAvoid
Unexpected free device in the mailDo not use

Get to the real site

Scammers buy search ads, and they run copies of wallet makers' sites. Type the address, or use a link from a trusted source. A price that looks too good is a warning sign.

Protect your privacy

Your order links your name and address to crypto. Past customer data leaks led to phishing and threatening letters. To reduce that risk:

  • Consider a separate email address.
  • Use a delivery address other than your home, such as a pickup point, if you can.
  • Avoid talking about your purchase online.

What to check when it arrives

  1. Inspect the packaging for signs of tampering, following the maker's guidance.
  2. Check that there is no recovery phrase or PIN in the box.
  3. Connect the device to the official app, which should verify its authenticity.
  4. Let the device generate a brand new phrase.

Then follow the first-day setup checklist.

Warning signs

  • A card in the box with words already written on it.
  • Instructions telling you to enter a given phrase.
  • A device that already has a PIN.
  • Paperwork that claims to be "pre-configured for your safety".
  • A demand to install software from a link in a letter.

If you see any of these, stop, and contact the maker through its official site. See also how to choose a hardware wallet.