That's quite interesting. "We could better learn about all the risk involved from the buyer's end"--- permit me to ask, does any retailer know the level of risk involved in each of these wallets? What I mean is; aside from the third-party risk (that a seller might temper with, and inject the wallet-drainer bugs or private keys stealers before each sale), could there also be a company-to-consumer risk?

I'm curious because the case of the Asian retailer had nothing to do with the source, but the seller himself.
C'mon old lady, you've said a lot but I'm trying not to relate it to the aforementioned user. 

Why should a device that's supposedly going to confide private keys be placed on a return policy? Are we pretending to not know the risk involved or we just blindly want to trust every user? The moment a package leaves the seller and reaches the recipients address, unless it was tampered by the delivery agents, any kind of malfunctioning whatsoever doesn't call for a refund. Let's all treat those devices as perishable goods--- the more people it gets to, the riskier it becomes.

I learned different rules apply to this; like once the seal is broken, the return policy doesn't cover that. There's also a window period to make a return. The security-sensitive nature of these wallets shouldn't permit anything like that.

Yes it is true that the Ledger company itself did not make any changes to their hardware wallets to steal users funds but still I will not trust any other hardware wallet because the company may make good products but if any such component is added during distribution or delivery through which they can steal funds then there is no benefit left in buying a HW.

I am happy that a few years ago a seller offered me some wallets that he had brought from another country and he was selling those wallets at a lower price. I think if I had bought those wallets I would be in exactly the same situation today. For some convenience I cannot throw away my hard earned money.

Whenever possible, the best option is to buy directly from the company, from the manufacturer. I mentioned in another topic: the risk we run when buying products from resellers is great, especially when it comes to electronic products. I know it can be difficult, but there is a possibility that they are counterfeit as well as adulterated.

Doing such thing will help them avoid to buy those compromised wallets, just like that incident happened on Cryptobilis.

Now that they have seen its possible for third party seller to do tampering of wallets, that means their buyer is not safe and better leave that idea about buying their wallets with them.

Many people suggest about official sources and actually I agree with them, since this is how they can assure that devices they bough is safe. Then not been passed on risky hands of some online resellers.

That's not an intentional act. They know their supplier, and they are in contract with them, which even after that company changed ownership, that's not supposed to be a problem, so I can't put blame on them heart of people are just corrupt once money is involved they can betray, as for cold card you blame them because they use weak entropy for their wallet which is understandable but on the other hand hackers are the bigger people to blame here, we should just be hopeful they don't find a loophole on what we use and trust.

The phenomenon of Cryptobilis along with Ledger Hardware Wallets are driving people away from hardware devices as they cannot trust any resellers, along with Cryptobilis, mediamarkt resellers selling Ledger devices as are you may have seen also not trusted as unauthorized spy chips and hardware implants have been found in the products they sell.

In fact many customers have lost their money due to these flaws in their wallets but I'm surprised that still they continue to sell these products,Ledger Hardware Wallet claimed that MediaMarkt had stopped selling all Ledger products in their stores and online platforms but their claims were false, because we noticed that a person from Germany went to another outlet in MediaMarkt to verify that they have stopped selling this device but they are still selling them.



https://x.com/0xJohannes_/status/2110029247238611203

If someone wants to buy a hardware wallet, they should buy it from the official website or store and my opinion after purchasing, they should check it thoroughly to see if it is safe for holding Bitcoin.

I used to say that your wallet security depends on you, what you do and how you do it but recently I’ve been proven otherwise, your wallet security is not longer your personal duty only but the entirety of users and community duties since the companies are vulnerable to and extent.

Buying from a third party is not really a good thing to do but what’s the guarantee that if you buy directly from the companies website or direct from them that you wouldn’t have to go through same fate as others? That is nothing to write about because even people who got their hardware wallets directly are in same panic.

Cold wallet on Airgapped devices are the only thing left to be brutally decrypted or hacked once that is done there is absolutely no place to run to and that’s my fear.

Hardware manufacturing supply chain concerns are indeed legitimate as the safety of factory shipments still remains prone to massive hacking. Protection of digital assets is finally becoming common issue, one that involves the honor of vendors, open source communities, and auditors all around the world.

Standalone device that does not use any internet connection can also become an object for a physical attack through the exploitation of microarchitecture weaknesses and manipulation of internal parts. The fear becomes apparent as the ultimate stronghold of cryptography starts becoming vulnerable to brute force computer assaults.