Disclaimer
The information provided on or accessed through TrueToCrypto.com (the “Website”) is for general informational purposes only and is obtained from independent sources that are believed to be reliable. However, TrueToCrypto.com, its owners, affiliates, officers, employees, and agents (collectively, “We,” “Us,” or “Our”) make no representations or warranties, express or implied, as to the accuracy, completeness, timeliness, reliability, or suitability of the information contained on or accessed through this Website. Further read Disclaimer.
The Cheapest Week of the Year — and the Riskiest
Black Friday falls on Friday 27 November 2026, with Cyber Monday on 30 November. For hardware wallets, it is reliably the cheapest week of the year.
Last year’s offers show what to expect:
- Trezor ran discounts of up to 40% across the Safe 3, Safe 5 and Safe 7 until 1 December 2025. The Safe 3 dropped to €47 from €79, and the Safe 5 to €101 from €169.
- Ledger cut the Nano X to half price (from €149), sold the Flex at €249 with $70 in bitcoin included, added $80 in bitcoin to the Stax, and took around 10% off accessories, including the CryptoTag Zeus metal backup. Coin Academy reported the campaign running until 21 December.
If you have been meaning to move your crypto off an exchange, this is when the hardware costs least.
The same week is also peak season for the three ways hardware wallet buyers get burned: fake devices, fake deals, and fake follow-ups. All three were documented in 2026, and all three are easy to avoid once you know what they look like.
Threat 1: The Fake or Tampered Device
What happened in 2026
In April 2026, a Brazilian security researcher bought what looked like a genuine Ledger Nano S Plus from a Chinese online marketplace — at exactly the same price as Ledger’s official store. The packaging and listing looked legitimate.
The device failed Ledger’s built-in Genuine Check. A teardown found scraped chip markings and a Wi-Fi and Bluetooth antenna inside the unit — the opposite of what a hardware wallet is for, since its whole purpose is to keep keys offline.
The QR code in the box sent first-time users to a malicious version of Ledger Live, which displayed a fake Genuine Check. Anyone who followed the prompts handed over their recovery phrase.
Two details matter. The price was not suspicious, so “too good to be true” would not have saved anyone. And the malicious app was designed to defeat the exact check a careful buyer would run.
Where fakes come from
- Online marketplaces and third-party sellers, including large, familiar ones
- Auction and second-hand sites
- “Open box”, “refurbished” and “like new” listings
- Social media shops and sponsored posts
- Any seller offering a deeper discount than the manufacturer’s own sale
The rule
Buy only from the manufacturer’s own website.
Update, 21 October 2026: this guide used to say that an authorised reseller listed on the manufacturer’s website was also fine. After October’s supply-chain case, we no longer recommend it. Ledger confirmed that devices sold through a Southeast Asian reseller contained hidden implants that captured the recovery phrase during setup — and those devices still passed Ledger’s Genuine Check. The same week, MediaMarktSaturn suspended Ledger sales in its stores and online after a customer in Germany reported an implant in a unit; Ledger said no funds were lost in that case. Buying directly from the manufacturer removes every extra link in the chain of custody.
Not from a marketplace listing that names the brand. Not from a seller with good reviews. Not at the official price from somewhere unofficial. The April 2026 case was a perfect imitation at the right price — the only defence that worked was where the device came from.
Never buy a used, refurbished or open-box hardware wallet. There is no discount large enough to justify a device someone else has handled.
Threat 2: The Fake Deal
Black Friday creates a flood of discount ads, deal emails and “exclusive code” posts. Scammers blend into it.
What it looks like
- Clone shops — lookalike domains copying a manufacturer’s store, often with a “Black Friday” banner and a countdown timer. They take payment and ship nothing, or ship tampered stock.
- Paid search ads that sit above the real store when you search for “Ledger Black Friday” or “Trezor discount”.
- Deal emails and DMs with a link to “claim” an offer.
- Fake companion apps. In April 2026, a fake Ledger Live app on Apple’s App Store was linked by investigator ZachXBT to roughly $9.5 million stolen from more than 50 victims before Apple removed it. An official app store listing is not proof an app is real.
The rule
Type the manufacturer’s address yourself, or use a bookmark you made yourself. Manufacturer deals are published on the manufacturer’s own site. If a discount only exists behind an ad, an email link or a DM, assume it does not exist.
Download companion software by following the link on the manufacturer’s website, which you reached by typing its address. Don’t search the app store and pick the top result.
Threat 3: The Follow-Up Scam
Buying a hardware wallet adds your name and address to an order database. Those databases leak, and the letters and emails come later.
In February 2026, security researchers flagged physical letters sent to Trezor owners. They carried official branding, holograms and a QR code, and announced a new “Authentication Check” that would become mandatory by a deadline. A Ledger-themed version, announcing a mandatory “Transaction Check”, had been circulating since October 2025. The QR codes led to scam sites built to harvest recovery phrases.
The scammers appear to draw on past breaches of customer data. Ledger’s 2020 e-commerce breach exposed more than a million email addresses and thousands of home addresses, and Decrypt reported a breach at a Ledger partner in January 2026 that affected order data. A breach of Trezor’s support portal affected roughly 66,000 users.
The rule
- No manufacturer will ever ask for your recovery phrase. Not by letter, email, phone, chat or app.
- No legitimate update or check starts with a QR code in your post. Updates happen inside the official app you already installed.
- Trezor says it will never contact you first. Treat any unsolicited contact as hostile.
Reduce what you leak
- Consider delivery to a parcel locker or pickup point rather than your home. Order databases leak, and a list of hardware wallet buyers with home addresses is exactly what physical attackers look for.
- Use a dedicated email address for crypto purchases.
- Don’t post unboxing photos. A picture of a new hardware wallet is an announcement.
What’s Worth Buying at Sale Prices
The usual advice still applies: the cheapest secure device, set up properly, beats an expensive one set up carelessly. Sale prices just change which upgrades are worth it.
| If you want… | Consider | Why |
|---|---|---|
| Your first hardware wallet | Trezor Safe 3 or Ledger Nano S Plus | Secure, simple, and the cheapest entry point. At sale prices, under €50 is possible |
| Mobile use and DeFi | Ledger Nano X | Bluetooth and the Ledger mobile app. Best value only when discounted, as it was last year |
| A colour touchscreen without the premium price | Trezor Safe 5 | Easier passphrase entry on the device itself |
| Long-term storage of significant value | Trezor Safe 7 | Open-source secure element and post-quantum cryptography |
| Protection against fire and flood | A metal seed backup | The best €50 you can add to any wallet. |
Should you buy two? A second device is a reasonable backup for large holdings, but a properly stored seed phrase already lets you restore onto any compatible device. For most people, a metal backup is the better second purchase.
Buying One as a Gift
Late November is also when people buy hardware wallets as presents. A few rules protect the person receiving it.
- Give it sealed. Don’t unbox it, test it or “set it up to make it easier.”
- The recipient must create their own recovery phrase. Never generate a seed for someone else, and never write one down for them. Whoever has seen the phrase controls the wallet.
- Don’t pre-load it with crypto. If you want to give crypto as well, send it after they’ve set up the wallet and confirmed their backup.
- Include three rules on a card: write the recovery phrase on paper only; never type it into a computer, phone or website; nobody legitimate will ever ask for it.
- Order direct from the manufacturer, even if a marketplace delivers faster.
When It Arrives: The 10-Minute Check
- Inspect the packaging. Look for broken seals, re-taping, or signs it has been opened.
- Look for anything pre-filled. If the box contains a recovery sheet with words already written on it, it is a scam. Do not use the device. Legitimate devices never ship with a recovery phrase.
- Ignore any QR code or leaflet that tells you which app to download. Go to the manufacturer’s site by typing the address, and download from there.
- Run the authenticity check in the official app. Ledger calls it the Genuine Check, and Trezor Suite checks device authenticity during setup. If it fails, stop and contact the manufacturer through its website. A pass is necessary but not proof: the implanted devices found in October 2026 passed Ledger’s check.
- Let the device generate a new recovery phrase. Write it on paper, by hand, and confirm it on the device.
- Send a small test amount, then confirm it arrives, before moving anything significant.
Frequently Asked Questions
Is it safe to buy a hardware wallet on Amazon? We no longer recommend it. Buy on the manufacturer’s own website instead. In October 2026, tampered devices with hidden implants were sold through a reseller and third-party marketplace sellers, and they passed the manufacturer’s authenticity check.
Is a cheaper listing for the same device a good deal? No. A price below the manufacturer’s own sale price is a warning sign. And in the April 2026 case, the fake was sold at the official price, so price alone proves nothing either way.
Are Black Friday devices any different from regular stock? No. The devices are the same, and only the price changes.
What if my device came with a recovery phrase already written down? Don’t use it. Contact the manufacturer through its website and report the seller. A pre-set recovery phrase means someone else already controls any wallet created from it.
I got a letter asking me to scan a QR code to activate a security feature. Is it real? No. Manufacturers don’t do this. Throw it away, and never enter your recovery phrase anywhere a letter, email or QR code sends you.
Can I buy a used hardware wallet if I reset it? We don’t recommend it. Tampering can survive a reset and may not be visible. The savings aren’t worth the risk.
The Bottom Line
Black Friday is the best week of the year to buy a hardware wallet, and 2026 showed exactly how buyers get caught out: a perfect counterfeit at the official price, a fake app in a real app store, and a convincing letter months later.
Three rules cover all three:
- Buy direct from the manufacturer, and type the address yourself.
- Download software only from the manufacturer’s website, never from a QR code, leaflet or search result.
- Nobody legitimate will ever ask for your recovery phrase, by any channel, for any reason.
Get the deal. Then spend ten minutes setting it up properly.
AI-Powered Crypto Heists: The Frontier of Digital Crime in 2025Seed Phrase Security Guide 2026 | How to Back Up & Protect Recovery KeysWallet Drainers 2026: New AI Tactics & Prevention GuideExposing Crypto Exit Liquidity Traps: Your Guide to Staying SafeHow Wallet Drainers Work in 2026: Full Technical BreakdownSeed Phrase Security Guide 2026 | How to Back Up & Protect Recovery KeysWallet Drainers 2026: New AI Tactics & Prevention Guide
