# Malicious Insider Key Theft In a typical customer setup, Casa provides all the hardware wallets (we are an authorized reseller of both Trezor and Ledger). The Casa app is downloaded directly from either the Apple iOS App Store or Google Play Store. If an insider attacker got a customer to install a malicious version of the app and provided the customer with malicious hardware devices, it would be possible for an insider to steal the user’s keys. **Mitigation:** * Casa is an authorized reseller of both Trezor and Ledger, so the devices we provide come directly from the manufacturer. * Casa supports the use of hardware wallets obtained directly from manufacturer or from other authorized hardware wallet retailers. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.casa.io/wealth-security-protocol/remaining-attack-vectors/malicious-insider-key-theft.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.