Coldcard and Ledger attacks raise questions about hardware wallet security

​Two major security incidents involving Coldcard and Ledger have shaken confidence in cryptocurrency hardware wallets. The attacks have exposed vulnerabilities in devices long considered among the safest ways to store Bitcoin. Now, Peter Todd, Jack Mallers, and other prominent industry figures are questioning whether dedicated hardware wallets are worth the risks, or whether alternative approaches offer better protection.

2026 has arguably been the worst year on record for Bitcoin-related security incidents. That's not necessarily because of how much Bitcoin was lost, but because of how hard two of the worst attacks of the year hit what was long treated as the gold standard of crypto storage: hardware wallets. Custody experts are now openly questioning whether crypto-specific hardware makes sense at all, while others note that they've been sharing their reservations about these devices for years. Of course, many also argue that abandoning hardware wallets entirely would be an overreaction.

As a reminder, Coinkite disclosed over the summer that a firmware bug dating back to 2021 caused some Coldcard devices to generate seeds with weak randomness, letting attackers recreate private keys offline and sweep funds. Users had trusted a single vendor's firmware to do the most basic job of a wallet, generating a random secret, with no easy way to know it had failed.

Then, this month, Ledger confirmed that attackers had been opening genuine devices and fitting them with custom implants that read recovery phrases off the screen during setup and sent them out over a cellular connection. Ledger's secure chip was never broken; the problem was that nobody could easily tell whether the device in their hands was the same one that left the factory without any alterations.

Third-party estimates put the damage at more than $100 million apiece for the Ledger supply chain attack and the Coldcard incident, which makes it clear why there is now so much paranoia in the crypto space when it comes to secure storage of funds.

The problems go beyond Coldcard and Ledger

Strike CEO Jack Mallers recently laid out several general drawbacks of hardware wallets on his show. "Hardware wallets, in my opinion, they are riskier than the market or like the general public seems to believe," he said. He added, "There's just a lot of implied trust there in like shipping a device that hasn't been tampered with, the supply chain. There's so many parties involved."

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Mallers also noted that open-source firmware still needs enough reviewers to be trustworthy, contrasting Coldcard's relatively small contributor base with Bitcoin Core's much larger one. Buying a hardware wallet can also expose customers' email and shipping addresses if vendors or their partners suffer data breaches, he said, pointing to previous Ledger customer data leaks and a recent incident involving Trezor's shipping provider.

"Now hackers know where you live and you're seeing physical attacks on people," he said, pointing to the surge in "$5 wrench" attacks on crypto holders over the past couple of years.

General-purpose hardware vs. crypto-specific devices

One potential weakness of hardware wallets is precisely what makes them useful: they're built for a single purpose. Anyone buying one is signaling that they may be storing valuable private keys, making these devices attractive targets for supply-chain attacks.

Bitcoin Core contributor Peter Todd has long avoided them for this reason. "I personally don't use hardware wallets," he wrote on X. "I rely on the security of @QubesOS in conjunction with commodity hardware (eg Thinkpad laptops and Raspberry Pis) bought anonymously."

Todd argued that generic hardware is far harder to target because an attacker would need to backdoor a huge number of devices to hit the few being used for crypto. "Generic hardware is an enormous improvement over hardware wallets, because an attacker needs to backdoor far more units to attack a niche use case," he added. "Maybe 1-in-100 laptops or Raspberry Pi's will ever store crypto currency on them."

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Of course, this isn't a new take from Todd. In fact, he and others have been making this argument for at least eight years. Mallers also made a similar point on his show. Additionally, he suggested that Bitcoin Core on an offline laptop can be enough for long-term holders, with hardware wallets making more sense for people who need to sign transactions on a more regular basis.

That said, Foundation CEO Zach Herbert warned on X that DIY hardware isn't a cure-all either. "How soon until Amazon sellers are modifying Raspberry Pi's and other dev boards, hoping that someone uses it for Bitcoin or crypto storage?" he asked.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The case for hardware wallets

Not everyone is ready to give up on hardware wallets quite yet. Coinkite has defended its transparent case design as a way for users to spot swapped components or implants. Ledger, meanwhile, has framed its incident as an attack on distribution rather than a failure of its secure chip or operating system. Ledger also says its upcoming device, the Ledger Atom, would have guarded against the specific kind of exploit used in the supply chain attack.

Others say hardware wallets can be made safer by generating seeds with dice rolls rather than trusting the device's randomness. "This is why bringing your own entropy is the safest and simplest path," Bitcoin Magazine technical and opinion editor Shinobi wrote on X.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Herbert has called for physical active tamper detection and more trustworthy manufacturing, while Todd highlighted tamper-evident shipping schemes like Entropy Seal as what Ledger should have been using. Herbert also pointed to another way of reducing the risks. "Multisig would have protected you here, but I am not sure if passphrase would have," he wrote.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

That's the argument for multi-vendor multisig, where keys are spread across devices from different manufacturers so that a single compromised device can't move funds. According to Ivy Galindo, head of growth marketing at BitGo, none of the Bitcoin stolen in the Coldcard exploit or the Ledger reseller attack came from a multisig setup.

"Multi-vendor multisig protects you against supply chain attacks," Casa co-founder Jameson Lopp also wrote, noting that Casa users were unaffected by the Ledger attack. Assisted custody providers like Casa and Unchained offer these setups for users who want help managing them without fully giving up control of their keys.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Personal responsibility is hard to outsource

This year's incidents should prompt crypto holders to reconsider how they secure their Bitcoin and other digital assets. The lesson isn't necessarily that hardware wallets are useless, but that no single device or company deserves blind trust.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The sad reality is that some people may be better off gaining exposure to Bitcoin through an ETF or a Bitcoin treasury company if they can't secure their coins themselves and don't have someone they trust to help them do it. That's a tough message in a system designed to remove trusted third parties in the first place. As LayerTwo Labs founder and CEO Paul Sztorc put it on X, "It's hard to outsource Personal Responsibility."