Is my hardware wallet genuine? How to buy a Ledger or Trezor safely
As of Oct. 16, 2026
Short answer: Buy from the maker's own store (ledger.com or trezor.io), the maker's official Amazon store, or a store on the maker's reseller list (for Ledger in the U.S., that list names Best Buy). Both makers warn against other sellers. When it arrives, it should come blank: no recovery words, no PIN, not set up. Then run the maker's check in the app you downloaded from the maker. No real company will ever ask for your recovery words.
Best move: buy new from an official source and set it up yourself
Buy new, from the maker or a listed reseller, and set it up yourself. If anything came pre-filled (words, PIN, already set up), or it arrived without an order, don't use it. Never type your recovery words into anything except the device.
A best fit for the situation described, not financial advice or a buy/sell recommendation. Partner links never change a pick.
Your roadmap
Order from the maker or a store on its reseller list. On Amazon, check the "Sold by" name matches the maker's official store (Ledger's advice).
When it arrives, look before you plug in: box and seal intact, recovery cards blank, no PIN slip.
Get the app only from the maker's website or the official app store, never from a link in the box, an email or a text.
Set it up yourself. Ledger runs its Genuine Check during setup; a new Trezor has no firmware and installs it during setup.
Write your words on paper only. Ledger: the only place your words ever go is the device itself.
Send a small test amount first, then the rest.
Where it's safe to buy (U.S.)
Maker
Official sources
What the maker says about other sellers
Ledger
Ledger's own shop; its reseller list for the U.S. names Best Buy USA, the Amazon USA Ledger store, and TikTok Shop US (Powerplay Retail). Ledger says its resellers are commercially encouraged to source stock from Ledger or its authorized distributors, and their contracts bar reselling returned devices.
"Purchasing from unlisted, unauthorised sellers adds a number of security risks." Amazon can show several sellers on one product page, so check "Sold by." Ledger Academy · Ledger
Trezor
Trezor's own shop (U.S. orders ship from Chattanooga, Tenn., Grapevine, Texas, and Phoenix), its official U.S. Amazon store, and its reseller list. Trezor says Amazon and reseller stock is supplied by Trezor and kept separate.
"Never buy a Trezor from an unauthorized third party, as you can never tell who may have had access to it before you." Trezor says it can't guarantee those devices. Trezor · Trezor · Trezor · Trezor
Other brands (Coldcard, BitBox, Tangem and more) publish their own reseller lists; use the maker's site to find it. Store lists change, so check the maker's page the day you buy.
What each check proves, and what it doesn't
Check
What it proves
What it can't tell you
Ledger Genuine Check (in the Ledger app, during setup)
The security chip is a real Ledger chip (a cryptographic test against Ledger's servers).
It can't detect a hidden add-on, such as a spying implant, if the real chip is still inside. It also only counts if the app came from Ledger: fakes often ship with fake apps that say "genuine." Ledger Academy
Trezor firmware check (during setup)
New Trezors leave the factory with no firmware. Setup checks for that, and the device checks the firmware's signature every time you connect.
If firmware is already installed on a "new" Trezor, Trezor says don't use it. A warning on the screen means unofficial firmware. Trezor
Trezor Safe 5 chip check
Its Secure Element (OPTIGA Trust M) takes part in an authenticity check the first time you connect.
Still check the seal and blank cards first; Trezor says to pause and contact support if anything looks off. Trezor
Seals and box
Trezor uses tamper-evident holographic seals (peeling one leaves "VOID"). Ledger says a package that looks opened or altered shouldn't be used.
Packaging designs change over time, and a perfect-looking box can still be fake. Use it as a first check, not the only one. Trezor · Ledger Academy · Trezor
Serial number lookups
Nothing for Trezor: Trezor says its devices have no serial numbers (the number on the box is a packaging batch).
Treat any "serial number check" site or caller with suspicion. Trezor
The 4 tricks Ledger warns about
Pre-seeded devices: a crook makes the recovery words before you get the device, puts them on a card or in the instructions, and keeps a copy. "The moment you fund the wallet, they can drain it." A real device never comes with words or a PIN.
Unsolicited "replacements": in May 2021 a user got a fake replacement Ledger in the mail with a letter urging a quick switch. It hid a soldered flash drive with malware, and about $78,000 was drained within 30 minutes of entering the 24 words.
Tampered devices: a real device changed after it left the factory, usually to copy what's on the screen. Ledger says its Genuine Check can't catch every physical change, which is why it recommends buying from Ledger or its resellers.
Counterfeits: look-alike devices, same branding and weight, often shipped with a fake app that "will happily report genuine." The fix: get the app only from Ledger's website or the official app stores and run the check yourself.
Source: Ledger Academy. Trezor gives the same core advice: buy from official sources, check the seal, and never use a device with firmware already installed or words already written (Trezor · Trezor).
Got a letter, call or package "from Ledger"?
Ledger's customer list was stolen in 2020. In its own words: about 1 million email addresses, and about 272,000 customer records with name, mailing address and phone number were dumped online on Dec. 20, 2020 (about 292,000 counting a separate Shopify incident). Ledger says people who bought after the end of June 2020, or bought outside Ledger.com, weren't exposed. Those records are why some owners get convincing letters, calls and packages.
Ledger: "NEVER give your 24 words to ANYONE. Ledger will NEVER ask you for your 24 words."
U.S. regulators agree: the CFTC says never give your private key or seed phrase to anyone, and that it would never ask for them.
FBI: if a caller says your crypto account has a problem, hang up and call the company's official number yourself. Don't use any link or number they give you. Report scams at ic3.gov.
Facts from the makers' own pages and U.S. regulators, with dates. We don't pick a brand here; see Ledger vs Trezor and best hardware wallet for our scored comparisons.
The checker is a list of questions, not a lab test. Only the maker's own check can test the chip, and even that has limits.
The $78,000 case and the breach counts are as Ledger reported them; we haven't verified them independently.
Reseller lists change. We read both makers' lists on Oct. 16, 2026; check the maker's page the day you buy.
Why trust this: every claim links to the maker or a U.S. agency with the date we read it, and VaultRubric takes no payment from Ledger, Trezor or any store named here.
Not financial or legal advice. Self-custody means no one can reverse a mistake. When in doubt, stop and contact the maker through its official website.
From the maker's official Amazon store, yes, according to both makers. Trezor says its official Amazon stock is supplied by Trezor and kept separate. Ledger lists the Amazon USA Ledger store as an authorized reseller and says to check that the "Sold by" name matches the official store, because Amazon can show several sellers on one product page.
My hardware wallet came with a recovery phrase card already filled in. Is that OK?
No. Don't use it. Ledger says a legitimate device never comes with a recovery phrase or PIN pre-configured, and Trezor says not to use a device whose backup cards already have words on them. Whoever wrote those words can take anything you send to that wallet.
Does Ledger's Genuine Check prove my device wasn't tampered with?
Not completely. Ledger says the Genuine Check proves the device has a genuine Ledger security chip, but it cannot detect physical changes such as spying implants if the original chip is still inside. That's why Ledger recommends buying from Ledger or its authorized resellers, and running the check with the app downloaded from Ledger's website or official app stores.
How do I know a new Trezor is genuine?
Trezor says to buy from its shop, its official Amazon store or an authorized reseller; check the holographic seal and that the backup cards are blank; and set it up in Trezor Suite. New Trezors ship without firmware, so if firmware is already installed, don't use it. The device checks the firmware signature each time you connect, and the Safe 5 also runs a Secure Element authenticity check.
I got a Ledger in the mail that I didn't order. What should I do?
Don't plug it in. Ledger says legitimate replacements are never sent unsolicited. In a May 2021 case, a fake replacement hid a flash drive with malware and the owner lost about $78,000 within 30 minutes of entering the 24 words. Contact Ledger through its official website.
Will Ledger, Trezor or the government ever ask for my recovery words?
No. Ledger says it will never ask for your 24 words, and the CFTC says never give your private key or seed phrase to anyone and that it would never ask for them. Anyone asking is a scammer.
Estimates, not financial advice. Taxes, insurance, PMI and fees vary by lender, county and city; confirm with your lender, dealer and state agency before acting.