Tampered hardware wallet bought in a store: your rights as a buyer under German law

If your hardware wallet contains foreign components, German law gives you two years of warranty rights against the retailer you bought it from: a new device, a refund of the purchase price or a price reduction. What you will almost never get is compensation for the coins that were drained through the device. That difference determines what a trip back to the store will get you, and since Wednesday it has become relevant for more buyers than before.

Singapore police have, for the first time, officially recorded what until now only the manufacturer and some media outlets had described: hardware wallets sold in stores contained malicious hardware components. Our article on the confirmed implant and how to check your own device explains how to narrow down the suspicion technically. This piece deals with the other half of the question: who is liable, for how long, and with what proof.

What Singapore police announced on October 28

The Singapore Police Force published an advisory on tampered hardware wallets on Wednesday afternoon. It states that at least two cases have been reported since September 10, 2026, with total losses of around 3.5 million Singapore dollars. At current exchange rates, that is about 2.7 million US dollars.

The core of the advisory: preliminary investigations found that hardware wallets bought from some retail stores in Singapore contained malicious hardware components. These components could capture users' recovery phrases or private keys, allowing unauthorised persons to access the wallets and drain holdings without the owners' knowledge or consent. The police say they are in contact with the manufacturer, which is reviewing the affected cases. Investigations are ongoing.

Two points of context belong here. First, this is a finding by an authority in an ongoing investigation, not a ruling and not a final determination of cause. The police explicitly speak of preliminary investigations. Second, the finding concerns devices from Singaporean stores. It says nothing about how many devices in Europe are affected.

What the police advise owners of a suspicious device

The authority's advice is short and practical. Do not enter a recovery phrase into a device under suspicion any more. Do not carry out further transactions with it. Contact the manufacturer through its official channels. And anyone who believes their phrase or private key has been compromised should transfer the remaining holdings, using an uncompromised device, to a new, trusted wallet with a newly generated phrase. Added to this is the warning every authority in this field gives: never share the phrase, not even with people claiming to be staff of the manufacturer, an exchange or a law enforcement agency.

Malicious hardware components: the technical core of the finding

A hardware wallet is a device that generates and stores your private key without handing it over to a computer or phone. Its entire purpose is that the key never leaves the device. How this works under normal conditions is set out in our explainer on how a hardware wallet works.

An extra component inside the casing undermines exactly that promise. It sits between the genuine components and can read what you enter or what the device displays. The timing is what matters: the tampering happens after manufacture and before purchase, on the way through distributors and stores. A supply chain attack is thus aimed not at the software, which you could update, but at the object in the box.

In practice, this means a reset does not help. If you generate a new phrase on the same device, you generate it on a device you can no longer trust. Earlier cases in this series were traced back to a reseller in Southeast Asia and showed the same pattern. That is why the police also recommend moving to a different device rather than cleaning up the old one.

The authenticity check in the manufacturer's app does not detect extra components

Many owners rely on the authenticity check that the manufacturer's app runs when the device is connected. The manufacturer itself made clear in October that this test does not detect hardware added afterwards. It checks whether the genuine secure chip responds, and the chip does so even when a foreign component sits next to it.

That is why a green tick in the app is no proof of innocence, and why looking at the packaging and the casing is worth more at the moment than any software message. If you also want to know how to spot a manipulated transaction in day-to-day use, see our article on blind signing and how to check it.

Material defect under Section 434 of the German Civil Code: a tampered device fails the objective requirements

Now to the legal position in Germany, which on this point is clearer than many expect. Under Section 434 of the German Civil Code (BGB), an item is free from material defects if, at handover, it meets the subjective requirements, the objective requirements and the installation requirements. The objective requirements include that the item is suitable for ordinary use and has the quality that is usual for items of the same kind and that a buyer can expect.

A hardware wallet containing a component that can capture the recovery phrase is not suitable for its ordinary use, and that use is the secure storage of a key. Such a device is therefore defective, regardless of whether the retailer knew about the tampering. Warranty under German sales law does not require any fault on the part of the seller; it only asks whether the goods were in order at handover.

If you are considering which device to switch to, you will find the current models and their differences in our comparison of hardware wallets. More important than the model is the purchase channel: directly from the manufacturer or from a partner it names itself.

Repair or replacement, withdrawal, price reduction, damages: the four routes under Section 437 BGB

What you can demand as a buyer is listed in Section 437 of the German Civil Code. The provision has three numbered items, behind which there are in practice four routes.

Subsequent performance. Under Section 439, you choose whether the defect is remedied or a defect-free item is delivered. With a tampered device, replacement is the sensible route, because a repair would not restore trust in that particular device. The seller bears the costs involved, expressly including transport and labour costs. So you do not pay for return shipping.

Withdrawal. You return the device and get the purchase price back. As a rule, withdrawal requires that you have first set the retailer a deadline for subsequent performance. That deadline is not needed if subsequent performance has failed or is unreasonable.

Price reduction. You keep the device and pay less. For a wallet whose security promise has gone, this is rarely the right choice, because its usefulness does not decline, it disappears.

Damages. This route is set out in Section 437 No. 3, and it is the hardest. More on that below.

Who the right opponent is

The warranty is directed against your contractual partner, meaning the store or online retailer where you made the purchase. Not against the manufacturer. The manufacturer can voluntarily offer a guarantee or an exchange, and in this situation it makes sense to contact it in parallel. But that does not give rise to a claim under the sales contract.

Two-year limitation period and one year of reversed burden of proof under Section 477 BGB

The deadlines are in Section 438. Claims for defects in movable goods become time-barred after two years, counted from delivery of the item. So the purchase date on the receipt is the starting point, not the day you discover the defect.

On top of that comes a rule that is worth a great deal in this case. Under Section 477, for purchases by a consumer it is presumed that the goods were already defective at handover if the defect becomes apparent within one year. In that first year, you therefore do not have to prove that the foreign component was already in the device in the store. The retailer would have to prove the opposite. After the year has passed, this is reversed, and then it gets difficult, because proving when a component was installed is laborious.

There is one exception to the two-year period: if the seller fraudulently concealed the defect, the regular limitation period applies instead of the short one. That requires the seller to have known about it. With tampering in the supply chain, that is the rare exception, not the norm.

The retailer is usually not liable for lost coins

This is where the unpleasant news lies. Damages under Section 437 No. 3 require fault on the part of the seller, meaning intent or negligence. A store that sells a sealed device from the official supply chain and could not have detected the tampering with reasonable effort is generally not acting negligently. That rules out compensation for the drained holdings, even though the claim to a new device or to the purchase price remains.

That is the asymmetry that makes this case so expensive for investors: you will quite likely get back 79 or 149 euros for the device, but not the value of the bitcoin or altcoins stored on it. Whether a loss of this kind can be claimed for tax purposes is a separate question; we have written it up for the case of a lost device and tax.

Only legal advice can give a binding assessment of your individual case. What is set out here is the framework within which the question is decided.

The Product Liability Act does not cover pure financial loss

At this point many people think of the German Product Liability Act, because it provides for claims against the manufacturer without fault. In this case it does not apply. Section 1 (1) of the act requires that a defect in a product causes someone's death, injury to their body or health, or damage to an item. In the case of damage to an item, it must also be an item other than the defective product itself, and it must ordinarily be intended for private use.

Drained crypto assets are none of these but pure financial loss, and that is not covered by this provision. The Product Liability Act helps with an injured finger, not with an empty wallet balance. Anyone who wants to take action against the manufacturer therefore needs another route, and that runs via proof of a breach of duty, not via the mere defectiveness of the product.

MediaMarkt and Saturn halted sales in October

For buyers in Germany, the case is not abstract. In mid-October, MediaMarktSaturn took the manufacturer's products out of its stores and off its own online platforms. The trigger was a report by a customer who says he found additional electronics in two devices from different branches. According to the reporting so far, this finding has not been independently verified; a spokesperson called it a precautionary measure. We covered the sales halt at MediaMarkt and Saturn on October 13, when it became known.

The manufacturer said at the time that no financial losses had been reported in connection with this German case. In parallel, it asked retailers and distributors in seven markets in Asia to suspend sales for the time being. A date for resuming sales in Germany has not been confirmed.

In practice this means two things. If you have an unused device from one of these stores at home, return it unopened instead of setting it up. And if you have one in use, you usually still have the receipt, which lets you prove the deadline under Section 438 cleanly.

Criminal complaint, securing evidence and the role of the police in Germany

Alongside sales law there is the criminal route, and it concerns the unknown perpetrators, not the retailer. Accessing someone else's wallet and draining holdings constitutes computer fraud and data espionage under German law. You can file a complaint at any police station and with the online police services of the federal states.

What a case needs documented

The value of a criminal complaint and of a warranty claim depends on the same material. This includes the receipt with date and branch, the original packaging including the adhesive seal, photos of the opened casing, the wallet addresses and the identifiers of the outflows with their timestamps. This material cannot be recreated after a fresh setup or after the box has been thrown away, and that is exactly why documenting comes before complaining.

A word on expectations: the clear-up rate for cross-border offences of this kind is low, and a complaint does not replace a claim against the retailer. It does, however, put the matter on record, and in many cases that is the precondition for an insurer or later proceedings to take the loss into account at all.

Hardware wallet: the two-year warranty runs from the purchase date

1. Holdings first, complaint second. If your device is under suspicion, transfer the remaining coins using a different, uncompromised device to a new wallet with a newly generated phrase. An orderly intermediate step is an account with a licensed exchange; which providers in Germany hold a MiCA licence is shown in our comparison of regulated crypto exchanges.
2. Document, then demand. Secure the receipt, packaging and photos, then ask the retailer in writing for a replacement or a refund, with a deadline. If you need custody without a new device in the meantime, the comparison of software wallets shows what the individual solutions offer and where their limits lie.
3. Change the purchase channel. Buy the next device from the manufacturer itself or from a partner it names, not on the open market. The models and their differences are in the hardware wallet comparison.

(As of October 29, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)