Multiple Security Issues Hit Hardware Wallet Sector
Six hardware wallet brands have disclosed security problems in 2026, though actual user losses occurred in only two cases. The incidents ranged from weak key generation to physical tampering and data exposures.
Specific Incidents Across Brands
On July 30, thieves began draining Coldcard wallets created with weak randomness. Galaxy Research reported Coldcard losses exceeded $115 million.
Ledger's security team used lasers to break chips in Trezor Safe 7 devices in June and Tangem cards in July. Both attacks required physical possession and specialist lab equipment. Trezor confirmed user funds remained safe, while Tangem stated the risk to everyday users was "virtually non-existent."
BitBox fixed several firmware vulnerabilities in August that its engineers classified as severe, reporting no stolen funds. Trezor's shipping partner leaked data on 13,689 buyers, and SafePal experienced a breach exposing nearly 40,000 home addresses.
Ledger Tampered Device Findings
Ledger confirmed that a victim's device contained an unauthorized hardware implant. Investigation revealed every confirmed case involved Malaysian reseller CryptoBilis. On-chain investigators estimated losses near $90 million, with one buyer losing 80 Bitcoin days after device setup.
CryptoBilis stopped hardware wallet sales. Its former co-founders stated they transferred the company to new owners in March. Some users reported purchasing Ledger devices from an official European store that lacked genuine features, though Ledger has not confirmed cases outside the CryptoBilis incident.
Recommendations for Users
Ledger advises buyers to purchase only from Ledger or authorized resellers. For CryptoBilis buyers, Ledger recommends not setting up unused devices and moving funds to a new recovery phrase. Ledger's Genuine Check confirms a device's security chip authenticity but cannot detect all physical modifications.
BitBox urges users to install updates and enter recovery words only on the device itself. Trezor notes that phishing remains the primary everyday risk. Ledger has called on other wallet makers to establish shared anti-tamper and chain-of-custody standards.
