How to Buy a Hardware Wallet Privately, and Safely
Why it matters who knows your address when you buy a hardware wallet, how to check the device is genuine, and how to pay for a Ledger or Trezor in crypto.
In short: Buy it sealed, from a seller that will not pass your address to the maker, pay in crypto from your own wallet, and verify the device with the maker's own genuine check when you set it up. Never use a device that arrives with a recovery phrase already written down.
A hardware wallet keeps your keys off your computer. It does nothing about the list of people who know you own one. In December 2020, a database from Ledger's online shop leaked, and the names, postal addresses and phone numbers of roughly 270,000 customers were published. Many of them received phishing mail and threats for years afterwards. The lesson is simple: the safest record of your hardware wallet purchase is one that never existed.
Who learns what when you buy
| Where you buy | Who gets your name and address |
|---|---|
| The maker's own shop | The maker, its shop platform and its courier |
| A big marketplace | The marketplace, often the seller, and the courier |
| Through us | Us and our courier. The maker sees our order, not yours |
We buy security items sealed from the maker and ship them to you ourselves. The maker never receives your name or address, and we erase it from our own records 90 days after delivery.
Is buying from a reseller safe?
Supply chain attacks are the reason makers warn against unknown resellers: a tampered device, or one sold with a recovery phrase "for convenience". Here is how to protect yourself, whoever you buy from:
- Check the packaging. Trezor devices carry a tamper-evident seal; look for damage or signs of resealing. A box that looks opened is a reason to stop.
- Verify the device itself. This is the check that matters. Ledger's app runs a genuine check against a secret only real Ledger devices hold, Trezor Suite verifies the Safe 3 and Safe 5 the same way, and the BitBox app checks its device's attestation. A failed check means do not use it.
- Generate the recovery phrase on the device. A genuine wallet creates the phrase itself, on its own screen, during setup. Any device that arrives with words already printed or written down must never be used.
- Never type the phrase into a computer or phone. No legitimate app or support person will ask for it.
We do not open, power on or set up any security device. "Checked on arrival" for these items means we inspect the outer packaging, and it reaches you sealed.
Choosing a wallet
- Trezor Safe 3: the affordable choice, with open-source firmware and a secure element.
- Trezor Safe 5: the same approach with a colour touchscreen.
- Ledger Nano X: supports a very wide range of coins, with Bluetooth for use with a phone.
- BitBox02 Bitcoin-only: for people who hold only Bitcoin and want less code to trust.
- COLDCARD Q: Bitcoin-only and built to stay offline, signing transactions by QR code or microSD card. For experienced users.
Paying privately
Pay from a wallet you control rather than from an exchange account, which links the payment to your identity. If you want the payment itself to reveal as little as possible, pay with Monero: it hides the sender, the receiver and the amount. The order page shows the exact amount and address, held for 1 hour.
The parcel
Every order ships in a plain outer box with no store name and no description of the contents. The plain packaging guide explains what that does and does not hide. Pair your wallet with a security key for your exchange and email accounts, and the two weakest points of most setups are covered.
Everything in this category is under wallets and security keys.