Buying a hardware signer from a third party seems sketchy, however this was an "Authorized" reseller, so presumably they had some kind of relationship with Ledger.
pull down to refresh
pull down to refresh
Buying a hardware signer from a third party seems sketchy, however this was an "Authorized" reseller, so presumably they had some kind of relationship with Ledger.
Cryprobilis shares a statement:
source
Sooner or later all bitcoin users need to be aware that some "targeted" devices are prone to supply chain attacks, and hardware wallets are, of course, such kind of devices to be aware of.
The first time I got really obsessed with the possibility of supply chain tampering was during the 2024 Lebanon electronic device attacks. Thankfully I am not involved at all with such events, but when I saw on the news what actually happened I really freaked out.
And it isn't only the tampering risk that should scare us, but also the possibility to be flagged during screenings. Current AI technology is very capable of spotting well known hardware. Just imagine when X-ray scanners at the airport become able to detect your tiny Trezor inside your luggage.
That's one of the reasons that made me begin this project: nds-signer – A #NintendoDSi software implementing #SeedSigner.
https://github.com/ndssigner/nds-signer/
My main obsession is to go unnoticed and reuse multipurpose hardware to avoid problems like the one we are witnessing.
Nothing is safe no more, be it hardware or softwares - 2 hardware exploit this year so far that I know of ~ Coldcard and Ledger - might I remind you that those are big name in the hardware game
Ledger is to blame here. Hardware wallet manufacturers should vet their “authorized resellers” more regularly.
I don't think that it is certain that this reseller is the actual problem. There are just a few signs pointing in that direction.
That being said, reselling hardware signers seems like it is just asking for trouble.
Someone I know was traveling through Asia when the Coldcard shitstorm happened. I believe they eventually bought a Ledger from a reseller. I hope it wasn't this one. I reached out to them just in case.
Yeah, it's turning in to a survival of the fittest scenario. Any weak link is getting exploited. I guess it's a good thing ultimately, but I am feeling a little paranoid about whether there are weak links in my own setup.
update: they bought a Trezor.
This topic also belongs in ~Scam_Reports
I almost posted it there, but didn't because I wasn't sure if it fit. I'll post such things there in the future.
Interestingly, Karpeles had some issues with this reseller a while ago:
source
Seems like Karpeles was posting about this yesterday. Maybe it spooked whoever was doing these:
So, while not verified, this rings true:
The Ledger verified reseller was purchased by Chinese company earlier this year:
source
Oh thanks so much this is very helpful 🙏
This is why we say buy direct from manufacturer and verify the device on first boot. If Ledger can't control their own distributors, the "authorized" sticker is just marketing.
This is a serious reminder that even an “authorized reseller” shouldn’t replace independent verification when it comes to self-custody. 🔐 Hardware wallets are only as trustworthy as the setup process and the security practices behind them. Always verify through official channels, never share your recovery phrase, and investigate carefully before trusting any third-party seller. Protecting your keys means protecting your Bitcoin. ₿