Trezor security chief: It's easier to trick users than hack a crypto wallet

​Hardware wallets are considered one of the safest ways to store digital assets. However, recent security incidents have raised doubts even about these devices. In an interview with Traders Union, Trezor's head of security, Jan Komarek, discusses cold wallet vulnerabilities, the risks associated with Bitcoin ETFs, and the challenges of passing cryptocurrencies on to heirs.

Why hardware wallets remain vulnerable

Trezor is the company behind the world's first hardware cryptocurrency wallet, introduced in 2014. Digital asset storage technology has improved significantly since then, but even specialized devices continue to face serious security challenges.

One of the most high-profile cases was the Coldcard security breach in July 2026. According to Galaxy Research, confirmed user losses exceeded $112 million. The incident was caused by a firmware bug that allowed attackers to reconstruct private keys without physical access to the devices.

Komarek believes the incident exposed a serious weakness in cryptocurrency security practices but did not undermine the case for self-custody.

“The Coldcard problem was a bug in Coldcard's own firmware. A code change in 2021 meant some of their devices skipped the hardware random number generator and used a weak software one instead. The seeds those devices created were far easier to guess than they should have been.”

However, vulnerabilities of this kind are not always discovered before attackers exploit them. This raises broader questions for manufacturers about the reliability of their devices' security architecture.

“The lesson I'd take from it is that critical security features should never depend on a single line of defense.”

Technical vulnerabilities, however, represent only part of the threat. Attackers increasingly prefer to bypass device protections by exploiting psychological manipulation and mistakes made by cryptocurrency holders.

“The weakest point today is usually the person holding the device, and attackers know it. Breaking a secure chip takes a lab and specialist equipment, if it is at all possible. Tricking someone into typing their recovery phrase into a fake website takes one convincing email.”

Which is safer: a hardware wallet or a smartphone?

Advances in mobile technology have raised questions about the need to purchase a separate device for storing cryptocurrencies. Modern smartphones come equipped with secure chips and can function as crypto wallets, while some experts recommend using a dedicated phone for this purpose. However, this approach has its limitations.

“Phones have good security hardware these days, so the argument isn't silly. The problem is everything else a phone does. It's online all the time and runs an operating system you have to trust and largely can't inspect.”

Keeping a smartphone completely offline can reduce certain risks, but it also makes cryptocurrency transactions more complicated. For many users, convenience remains just as important as technical security.

“There are cases where a phone wallet is the right tool. For small amounts you spend day to day, it's like cash in your pocket, and convenience matters. For savings, I'd use a hardware wallet.”

Does the number of supported cryptocurrencies affect wallet security?

Hardware wallet manufacturers take different approaches to supporting digital assets. Some devices are designed exclusively for Bitcoin, while others allow users to store dozens or even hundreds of cryptocurrencies. But does this versatility affect security?

“Every coin a wallet supports adds firmware, and more firmware means more places a bug could sit. That's a real trade-off.”

When choosing a crypto wallet, users often consider the number of supported assets, the manufacturer's reputation, and additional features. However, assessing a device's security without specialized technical knowledge can be difficult.

“But coin count isn't what decides whether a wallet is secure. Coldcard is a Bitcoin-only device, and the bug that hit it was in seed generation, which every wallet has. What matters more is how carefully that core code is written and whether people outside the company can check it.”

The other side of the Trezor-Ledger rivalry

Trezor competes with French hardware wallet manufacturer Ledger. However, the rivalry extends far beyond device sales. Security specialists regularly examine competitors' software and hardware components for vulnerabilities.

In particular, Ledger's Donjon research team has repeatedly identified potential issues in Trezor devices. Such discoveries may raise questions about product security, but Komarek does not view this practice as unfair competition.

“It's valuable, regardless of who the researchers work for. Ledger's Donjon team has reported its findings to us through responsible disclosure, we've fixed what needed fixing, and we've thanked them publicly.”

He points to research involving the Trezor Safe 3 as an example. The attack required Ledger researchers to have physical access to the device, and they were unable to extract private keys or PINs.

“We want as many people as possible looking for problems, and a competitor with a well-funded lab is about as motivated a reviewer as we could ask for. I'd like to see that level of outside scrutiny on every wallet on the market, and that's much easier when the code is public.”

Why Bitcoin ETFs create new risks

The introduction of spot Bitcoin ETFs in the U.S. has significantly changed how investors gain exposure to the cryptocurrency. Investors can now track Bitcoin's price movements through traditional brokerage accounts without creating their own wallets or managing private keys.

However, the growing popularity of these products has sparked debate over whether investing in Bitcoin ETFs can be considered a genuine alternative to owning cryptocurrency directly. The issue is particularly important for proponents of decentralization, who advocate direct control over digital assets.

“I don't see a contradiction. An ETF gives you exposure to the price of bitcoin. Holding your own keys gives you the bitcoin. They're different products for different jobs, and both can exist.”

The expansion of exchange-traded funds is also changing the structure of Bitcoin ownership. While individual users and cryptocurrency exchanges previously played a major role in the market, large financial intermediaries are becoming increasingly influential.

“From a security point of view there's also a concentration question. A small number of custodians hold most of the bitcoin inside US spot ETFs, which makes them a very large target. Self-custody spreads that risk across millions of individual devices.”

The difference between the two approaches goes beyond security and also concerns the owner's ability to control and use their assets.

“The worst outcome would be everyone deciding an ETF share is the same as owning bitcoin. With an ETF you can't move it, spend it or take it off the platform. Someone else holds the keys.”

How to pass cryptocurrency on to heirs

Self-custody gives digital asset owners full control over their funds, but it also makes them responsible for protecting their private keys. This becomes particularly challenging when cryptocurrencies need to be passed on to heirs.

Unlike bank accounts, access to a crypto wallet often cannot be restored through a financial institution or a court order. If the owner dies without leaving the necessary information, the funds may become permanently inaccessible.

Komarek acknowledges that there is still no universal solution to this problem.

“There's no single product that solves this today, and it's a big thing I think we should address. The hard part is that anything that makes it easy for your family to get in also makes it easier for someone else.”

One possible approach is to divide a wallet backup into several shares. Recovering access requires a specified number of shares, such as two out of three. These can be stored in different locations or entrusted to different heirs.

Another option is to use different passphrases to access separate hidden wallets, allowing the owner to decide in advance which assets each heir could inherit.

However, even a carefully designed inheritance arrangement cannot completely eliminate potential problems between those involved.

“Both options need some level of trust between you and the people inheriting.”

What prevents hardware wallets from becoming mainstream?

Despite the growth of the cryptocurrency industry, hardware wallets remain niche devices. Most investors prefer to store their assets on exchanges or use mobile applications rather than manage their private keys independently.

According to estimates cited by Komarek, only 12 million to 13 million of approximately 600 million cryptocurrency holders worldwide use hardware wallets. That represents roughly 2% of the market.

“Most people still picture self-custody as something for engineers. And they're anxious about the recovery phrase. What if I lose it? What if I write it down wrong?”

The challenge is not limited to technological complexity. Users are accustomed to financial services where banks or other institutions take partial responsibility for restoring access and resolving problems. No such intermediary exists with self-custody.

“A bank card feels familiar because a bank stands behind it. With a hardware wallet you're the one in control, and that needs explaining the first time. So the industry has to get better at teaching, in plain language and in person.”

Is Trezor planning an IPO?

Meanwhile, hardware wallet manufacturers continue developing their businesses and exploring new growth opportunities. As more cryptocurrency companies enter the stock market, questions arise about whether Trezor might also pursue an IPO.

Komarek does not disclose any specific plans for a public listing but emphasizes the importance of the company's independence.

“Trezor is independent, and we're proud of that. It means we don't need to answer to outside investors. Security has always been our first priority, and being independent means nobody outside the company can push it down the list.”

Ultimately, self-custody remains a trade-off between control over digital assets and personal responsibility for their security. Even as hardware wallets become more advanced, they cannot entirely eliminate fraud, the risk of losing access to funds, or the challenges of passing cryptocurrencies on to heirs.