Home › Knowledge Hub › Verify a hardware wallet
How to verify a hardware wallet is genuine before you trust it
A hardware wallet only protects you if it is genuine and untouched before it reaches you. A counterfeit that passes a fake authenticity check, a tampered device, or one that arrives with a recovery phrase already printed inside can hand your crypto to an attacker the moment you fund it. This guide shows how to buy a hardware wallet safely, verify it is authentic through the maker's own check, and set it up so the keys are yours and no one else's.
The whole point of a hardware wallet is that your private keys are created on the device and never leave it. That promise only holds if two things are true: the device is really made by who you think, and no one touched it or its keys before you. Attackers target both, because a wallet you trust is far more dangerous to you than one you suspect.
Why authenticity is the whole game
A hardware wallet you cannot trust is worse than no hardware wallet, because it earns your confidence and then holds your savings. Three failure modes matter.
- Counterfeit devices that look genuine and may even pass a faked authenticity check, built to leak your keys or recovery phrase to the maker of the fake.
- Tampered devices that were opened and modified somewhere between the factory and your hands.
- Preconfigured devices that arrive already set up, often with a recovery phrase supplied in the box or a card. Whoever supplied that phrase controls the wallet.
Supply-chain attacks on the authenticity mechanism itself are real. In October 2026, Keystone said an attacker stole the factory key its devices use to prove they are genuine, and the company began destroying unsold stock precisely so a counterfeit could not pass its online check and reach a buyer. The lesson for the rest of us is to treat authenticity as something you actively verify, not something you assume.
Buy from the source, never a reseller
Where you buy decides most of your risk.
- Buy only from the manufacturer's official store or an authorized reseller listed on the maker's own site. Open the maker's site by typing its address, and follow its link to buy.
- Avoid third-party marketplace listings, even on large, reputable marketplaces, where a seller you do not know fulfils the order. This is a common route for tampered and counterfeit units.
- Never use a hardware wallet you were given, found, or won. A wallet as a gift or prize is a classic setup for theft.
- Reject any device that arrives unexpectedly. If one shows up you did not order, especially after a data breach exposed your address, treat it as an attack and do not use it.
Verify authenticity through the maker's own check
Reputable makers provide a way to confirm a device is genuine, usually through their official app or a page on their site, and many use tamper-evident packaging.
- Check the packaging and the device for tampering before anything else: broken or resealed seals, scratches around the casing, or a box that looks opened. When in doubt, stop.
- Run the manufacturer's authenticity check from the official app or site you reached yourself. Do not use a link, QR code, or "verification site" that came with the device or in a message.
- Understand the check's limit. An authenticity check confirms the device is what it claims, but as the Keystone incident showed, the mechanism itself can be compromised. Authenticity is necessary, not sufficient, which is why the setup step below matters just as much.
Set it up so the keys are yours alone
This is the step that defeats a preconfigured or tampered device, because it puts the keys beyond anyone who handled the hardware before you.
- Generate a brand new recovery phrase on the device itself, during first setup. The device should create the phrase; you write it down from the screen.
- Never use a recovery phrase that came with the device, printed on a card, shown in a leaflet, or sent to you. A genuine new wallet never ships with a phrase already chosen. That is always theft.
- Install firmware and the companion app only from the maker's official source, reached by typing the address. Let the official app drive any firmware update.
- Set a PIN, and record your recovery phrase offline, on paper or metal, never as a photo, a note, a cloud file, or anything typed into a website. Our guide on securing a cold wallet covers storage.
- Confirm the device shows and verifies transactions on its own screen. That on-device check is the protection our guide on verifying what you are signing explains in depth.
If you think a device or its setup was unsafe
Do not move funds to it, and do not keep funds on a wallet whose phrase may have been seen by anyone. Move any assets to a wallet created fresh on a device you have verified, using a new phrase. If you used a phrase that came with a device, consider those funds at risk and act immediately. Preserve the packaging, any supplied cards or messages, and where you bought it, in case you report it.
Red flags
- A hardware wallet bought from a third-party marketplace seller, or received as a gift, prize, or unexpected delivery
- Packaging or seals that look opened, resealed, or damaged
- A device that arrives already set up, or with a recovery phrase supplied in the box
- A "verification," "activation," or "recovery" site reached by a link, QR code, or message rather than typed yourself
- Any instruction to enter an existing recovery phrase to "import," "sync," or "activate" the device
What this guide cannot do
It cannot inspect your specific device for you, and no checklist fully rules out a sophisticated supply-chain attack on the authenticity mechanism itself. What it can do is remove the common ways a bad device reaches you and earns your trust: buy from the source, verify on the maker's own check, and generate your own new phrase so the keys are yours before you ever add funds.
This is general information, not legal or financial advice.
Use Chain Pursuit's free tools to understand your options and preserve evidence. Never share your seed phrase, private keys, passwords, or one-time codes with anyone.
Sources
CoinDesk, Crypto wallet maker Keystone to destroy almost 19,000 devices after security breach, 27 October 2026. https://www.coindesk.com/business/2026/10/27/crypto-wallet-maker-keystone-to-destroy-almost-19-000-devices-after-security-breach, on the theft of a device authentication key and the risk of counterfeits passing authenticity checks.
Federal Trade Commission, What To Know About Cryptocurrency and Scams. https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams, on the finality of crypto transfers and the absence of the reversals that apply to other payments.
Cybersecurity and Infrastructure Security Agency, Secure Our World. https://www.cisa.gov/secure-our-world, on verifying software and devices through official, independently reached channels.
The device-integrity principles here are consistent across the sources above and our own reviewed guides. Reviewed quarterly.
Frequently asked questions
How do I know my hardware wallet is genuine and not a fake?
Buy only from the manufacturer or an authorized reseller listed on the maker's own site, check the packaging and device for tampering, and run the maker's authenticity check from its official app or site reached by typing the address. Then generate a brand new recovery phrase on the device yourself, which makes the keys yours regardless of who handled the hardware.
Is it safe to buy a hardware wallet from a large online marketplace?
Only if the manufacturer itself, or an authorized reseller the maker lists, is the actual seller and fulfiller. Third-party marketplace listings from unknown sellers are a common route for tampered and counterfeit units. When in doubt, buy direct from the maker's official store.
My hardware wallet came with a recovery phrase already printed. Can I use it?
No. A genuine new wallet never ships with a recovery phrase already chosen. A supplied phrase means whoever supplied it controls the wallet, and any funds you add can be swept. Do not use the device for storage; it is a theft setup.
Does passing the authenticity check mean the device is completely safe?
It is necessary but not a guarantee. As the October 2026 Keystone incident showed, the authenticity mechanism itself can be compromised, so a counterfeit might pass a check. That is why you also buy from the source and generate your own new recovery phrase, rather than relying on the check alone.
A hardware wallet I did not order arrived in the mail. What should I do?
Treat it as an attack and do not use it, especially if your address may have leaked in a data breach. Unexpected devices can be preconfigured or tampered to steal funds once you add them. Set it aside, and buy any wallet you want directly from the maker.
Do I need to buy a new device, or can I reset a used or suspect one?
If a device may have been tampered with or its recovery phrase seen by anyone, do not rely on it, because a reset cannot undo hardware tampering. Buy and verify a new device from the source, generate a fresh phrase, and move funds there. The cost is small next to what the wallet protects.
Not sure if your device or its setup was safe?
Eleven questions that show what to check and what to do next, with no email required.
Check my case