Tampered and Fake Hardware Wallets: How to Buy One Safely

A fake hardware wallet is a counterfeit or tampered device designed to steal your crypto, usually by shipping with a pre-set recovery phrase or by secretly leaking the one you create. The safest defense is simple: buy only from the manufacturer or an authorized reseller, verify the device during setup, and never use a wallet that arrives with a recovery phrase already written down.

Hardware wallets are one of the best ways to protect crypto because they keep your private keys offline. That reputation is exactly why scammers copy them. A compromised device gives you a false sense of security while someone else holds a copy of your keys.

How Tampered and Fake Wallet Attacks Work

There are several variations, but most follow this flow:

1. 1The device is obtained or produced. Scammers buy genuine devices and modify them, or produce counterfeit hardware made to look like a popular brand.
2. 2It is resold through unofficial channels. Marketplaces, auction sites, social media shops and "discount" stores are common routes.
3. 3A trap is set. The package may include a scratch card with a "recovery phrase" and instructions to use it, or the modified firmware may record the phrase you generate.
4. 4You deposit funds. Because the device looks normal, you send crypto to it.
5. 5The attacker drains it. Since they hold the recovery phrase, they can restore your wallet on their own device and move everything — often waiting until the balance is large.

A related tactic is the mailed "replacement" scam: people receive an unrequested device in the post with a letter saying their old wallet is insecure and must be replaced. The device is modified to steal the recovery phrase you enter during "migration." Our article Supply-Chain Attacks expands on this point.

A Hypothetical Example

This scenario is invented to illustrate the pattern.

Imagine Priya finds a well-known hardware wallet model on a marketplace listing at a noticeably lower price than the official store. The box arrives with intact-looking packaging and a printed card reading "Your recovery phrase — keep safe," followed by 24 words. The instructions say to enter these words during setup "for faster activation." See also: Password Managers and Crypto.

Priya follows the instructions, sends her savings to the wallet, and everything looks normal for weeks. Then her balance disappears. The seller had kept a copy of those 24 words. Nothing was wrong with the blockchain or the brand's real devices — the device and instructions were the trap. If you want to go further, read Wallet Validation and Synchronization Scams.

Warning Signs Checklist

• A recovery phrase is included in the box, on a card or in the instructions.
• The device is already set up, asks for no PIN creation, or shows existing accounts.
• The price is well below the manufacturer's price.
• The seller is not listed as an authorized reseller on the official website.
• Packaging shows signs of resealing, damaged security seals, glue residue or missing parts.
• Instructions direct you to a website or app other than the manufacturer's official one.
• A device arrives unrequested, with a letter urging you to "migrate" your funds.
• The companion app's genuineness check fails or warns about the device.

How to Buy and Set Up a Hardware Wallet Safely

Before you buy

1. 1Go to the manufacturer's website by typing the address yourself — beware phishing through search ads.
2. 2Buy directly there, or from a reseller listed on that official site.
3. 3Avoid second-hand devices, even from people you know.

When it arrives

During setup

• Let the device generate a new recovery phrase and write it down yourself, offline.
• Never type your recovery phrase into a computer, phone or website.
• Update firmware only through the official app.
• Send a small test amount first, then confirm the receiving address on the device screen.

Our step-by-step guide on how to set up a hardware wallet covers the full process, and how to choose a hardware wallet explains what to look for before you buy.

Protecting Yourself After Purchase

• Store your recovery phrase offline, in a secure place — consider steel seed phrase backups for fire and water resistance.
• Treat any message, email or letter asking for your recovery phrase as a scam. Manufacturers never ask for it.
• Keep your purchase details private; leaked customer data can lead to targeted phishing and mailed scams.
• Verify every address on the device screen before approving a transaction.

What to Do If You Suspect a Compromised Device

1. 1Stop depositing to the suspect wallet.
2. 2Get a genuine device from an official source, or use another trusted wallet temporarily.
3. 3Create a brand-new recovery phrase on the trusted device.
4. 4Move all funds from the suspect wallet to the new one as soon as possible.
5. 5Contact the manufacturer with details of the seller and the device.
6. 6Report the seller to the marketplace and, where relevant, to police or your consumer protection agency. You can also tell us through our reporting form.

If funds have already been taken, follow what to do immediately if your wallet is compromised.

Bottom line

A hardware wallet is only as safe as its supply chain. Buy from the manufacturer or an authorized reseller, reject any device that comes with a recovery phrase or arrives unrequested, run the official genuineness check, and generate your own phrase offline. Those few habits remove nearly all of the risk from fake and tampered devices.