Hardware wallets - should they still be recommended as safe?

[BlackHatCoiner]

For starters, you shouldn't be using anything that is related with Bitcoin and is closed-source. Especially now that AI can decompile code easily, and find vulnerabilities that cannot even be reported. Secondly, yes, you shouldn't consider any of those hardware wallets panacea.

Those ledger wallet bought from a shady third party were modified hardware. It is not fair to blame ledger.

If resellers can modify hardware components of the device so easily, then shouldn't Ledger warn the users about potential resellers that might turn out to be malicious? Or not engage in reselling their devices in the first place, and only purchase them at their own e-shop?

[Hatchy]

Note: hackers and scammers can develop; they always come up with new plans and develop much more powerful tools to attack those hard wallets. Offline wallets are much more powerful than this because you know what's inside your PC but are vulnerable only to physical attacks.

The truth is that there is no guarantee that any wallet is 100% secure. One thing I have always wondered about hardware wallets is how we can be sure they have not been tampered with at the factory by employees. These people already know the main purpose of these devices, so what if someone secretly plans to compromise them and steal users' funds in the future? With everything happening in the crypto market, we should understand that no wallet is completely risk-free. All we can do is take the necessary precautions to protect our funds and manage them properly. We should also avoid putting all our eggs in one basket.

[Asiska02]

Short summary (if I get it right):
- a shop in Malaysia that was listed as an official authorised Ledger reseller, operated as such for years
- secretly they were adding spying microchips to every hardware wallet
- they would repackage wallets to make them look legit and untampered
- this allowed them to spy and steal bitcoins from unsuspecting victims

Hardware wallets may have faced a lot of hacks recently but that doesn't make them outrightly bad and not seen as a suitable option for saving bitcoin. The number of continuous hack just keeps telling and emphasising that not all hardware wallet should be trusted blindly. The issue arising here is that third parties that are having access to this wallets are the ones infiltrating into them, can’t this hardware companies look for an alternative to that, to deliver these devices to their customers directly. This will further secure the wallet and their reputation. And for this that has happened, the companies will be blamed for it and let them take actions on the third party delivery companies.

[MusaMohamed]

For starters, you shouldn't be using anything that is related with Bitcoin and is closed-source. Especially now that AI can decompile code easily, and find vulnerabilities that cannot even be reported. Secondly, yes, you shouldn't consider any of those hardware wallets panacea.

Having source code from open source wallets will be very helpful for community to reproduce and check wallets. If there are severe security issues, they will be reported by Bitcoin developer and user communities.

People can use https://walletscrutiny.com/ for checking wallet scrutiny reviews and with beginners, it's very important. They can not check such things by themselves but they can check community reviews.

The rise of machine and lesson: assume machines read your code

[Faisal2202]

Well, trust is important, and almost every centralized platform relies on it, but BTC is trustless, so you don't have to trust anyone because everything is programmed.

Even by logging in to this forum, you are trusting the administration not to give your IP address to the authorities when asked, and you could end up in some kind of questionable situation because of it. It's a possibility, though. I just mean to say that with everything that's not decentralized, we have to trust someone.

Speaking of these wallets, they can be trusted, and nothing much has changed. The Coldcard incident put the same question in everyone's mind about whether they should trust hardware wallets or not.

Well, for the time being, almost everyone who has bought a Trezor or Ledger has been exposed to wrench attacks because their data has been breached.

Most of them could lose their money at some point due to artificial reasons. But it doesn't mean we should stop trusting them. For the time being, everyone is preferring platforms with SAFU, which is a good option, really. But in the long run, it can be hard for these people to trust decentralization again, and that's how centralization wins too. But it also doesn't mean we should keep losing our money to these hacks and unknown hackers from North Korea that governments have failed to catch since the beginning, while these hacks are benefiting the same governments directly and indirectly.

[macson]

I don't want to be so quick to say that hardware wallets are unsafe just because of these incidents. There are still plenty of hardware wallet users who are perfectly safe and haven't had any issues with their devices. It's just that this series of incidents makes it harder for me to trust hardware wallets right now --- paper wallets or airgapped devices sound more reliable to me than trusting devices from these companies.

[YellowSwap]

In my view, I think they’re among the safest options out there, despite what’s happened, provided you’ve taken the necessary precautions

No wallet is safe anymore, but hardware wallet is safe than software wallets. We just need to be careful on our wallet security and take every precaution measures to make sure that we don't become a victim to hackers.

Let us just assume that you have $50000 in bitcoin but you lost $45000 to what happened to Coldcard users or what happened to Ledger users recently. Will you still say that hardware wallet is safe? Not the hardware wallet users fault but they lost huge amount of money.

I hope people will see how hardware wallets are not necessary and go for other alternative cold wallets.

So can you atleast name few alternative cold wallets you are referring to?
I really want to see the names you have in mind.

Another thing I want to say is Ledger was never a airgapped device though, this added anything up?

[BABY SHOES]

The situation is now precarious, then it is better not to recommend the hardware to anyone... As for you can judge for yourself which is the best, because I myself still believe there are still manufacturers that can be trusted for hardware, so not all of them are bad.

As for rogue third parties compromising the device, this is not entirely wrong for the company but they are not careful in this regard, or they initially want more resellers so that their products can sell a lot, which in the end they miss.

One should also try to store their bitcoins on a mobile phone, then leave it do not connect to the internet, let this be storage.
I say this because many suggestions on social media they are still safe.

[PostQuantumBTC]

So can you atleast name few alternative cold wallets you are referring to?
I really want to see the names you have in mind.

Paper wallet, wallet on airgapped device and seedsigner. There are still one or two more that I have seen user like Pmalek posted about but I am not able to remember their names and I am unable to see the post. As I mention him on this thread, he will give you more alternatives.

[Mrbluntzy]

The only reason why people use hardware wallet it support multiple coins, and they are easier to use than having multiple wallets in a single device.

Sorry to ask, but which one are you particularly referring to as the official wallet?

So having cold storage or an offline device that you know never reaches the internet is still much safer than using hardware wallets that come from an authorized reseller or even directly from the manufacturer.

I agree that it is still safe for someone to have their wallet in a device that they keep away from internet activities but I guess some people do not really know that such method can also be much safer than some hardware wallet which could also be compromised from the seller's end. I remember when I started off on this forum, I used to see members recommending hardware as the safest cold storage and I believed it was but the security bridge incidents that is happening lately has just change my believe as to that and I don't even feel I can recommend hardware wallet to someone but instead this method you mention could be even safer, I have seen tech member here repeatedly recommend it too.

[HelliumZ]

The unexpected Coldcard Hardware Wallet scandal in 2026 has undoubtedly made us think about hardware. All the hardware wallets that we have accepted as the most trusted and secure wallets have been hacked over time. Then gradually people will lose trust in hardware wallets. So where can investors like us find a trusted wallet to hold cryptocurrencies including Bitcoin? Where holders' trust in hardware wallets is gradually eroding, let alone software orders. So is it that hardware wallets are not able to ensure their security in the current generation in the era of artificial intelligence?

[lionheart78]

It is funny to think how we used to think Hardware wallet is one of the best cold storage to keep our BTC safe.  Now that many security issues have happened that result to huge amount of losses to hardware wallet users, I do not think that i would be sure to recommend hardware wallets as safe.

I think it is better to promote making an airgapped wallet (there are lots of tutorials out there on how to make them and make it secure).  This way, all the creation from seed phrases or private keys to the security of the airgapped wallet is done by us personally.  There is no third party involved that can endanger our stashed Bitcoin.

[bitmover]

If resellers can modify hardware components of the device so easily, then shouldn't Ledger warn the users about potential resellers that might turn out to be malicious? Or not engage in reselling their devices in the first place, and only purchase them at their own e-shop?

Every hardware device can be modified.  They can just open and remove everything from inside and close again.

This happened to ledger but could happen to other companies as well. Maybe already happened but in a smaller scale.

[Hamza2424]

The only reason why people use hardware wallet it support multiple coins, and they are easier to use than having multiple wallets in a single device.

Hmm, well, that's a good reason but not good enough for me, because most of them buy only one or two coins. I had only one at that time, and I wanted to see the security, and the feeling of having one is awesome haha. But the reasons for everyone were obviously not the same.

Offline wallets are much more powerful than this because you know what's inside your PC but are vulnerable only to physical attacks.

Yep, they are only vulnerable to physical attacks, and so far, I have not heard of any such attacks on offline wallets. If there have been any, then you can list them. But everyone should learn how to create air-gapped wallets now, even just for testing purposes.

Although several physical attacks, like wrench attacks and eavesdropping, have been reported, they have not been directly linked to these offline devices, where funds were stolen by inserting a virus via USB media, etc.

[Cookdata]

I have recommended alots of hardware wallet and alternatively suggested going for airgaped device. I think going henceforth, a wallet you DIY will be worth giving priority than buying a hardware wallet at expensive price only to get drained before your eyes. If you are not a victim, you wouldn't understand the magnitude and damage some of these hardware wallet has caused, the only reason why some people have not change their mind is because these attacks are from manipulated distributora and are not from the source, but we can't even verify yet, we believed that because that's the only information we have for now.

I mean I don't have to do too much to own a mini pc with top configurations. 4gb ram and 128gb ssd laptop can provide a good airgap device. All you need is boot a privacy image like tailos, boot it with your USB flash and you will get one of the best cold storage for life. It's not that complex, you just need to back up your wallet like you do with hardware wallets. You will sleep better than this viral news of hardware wallet attacks. Until then, we will wait for the new development to stop these attacks.

[Hazink]

You just trusting 3rd parties with your funds and having knowledge to protect your wallet is a must if you want to avoid those online attacks. Having a hardware wallet is just a shortcut, but the bad side is you don't know how it protects your wallet even though the open-source code is provided. Do you think you can read it and say that the device is super secure and that no one can crack it?

This part got my attention. We always advocate for an open source wallet, but not everyone can actually read the code even when it's made public and most of us, including myself, trust the review and audits done by others on the code to know how trustworthy the code is and most of the time what's mostly looked at is if there is no backdoor on the code which extract information of users etc. 

Note: hackers and scammers can develop; they always come up with new plans and develop much more powerful tools to attack those hard wallets. Offline wallets are much more powerful than this because you know what's inside your PC but are vulnerable only to physical attacks.

The more technology is advancing, that's how it also increases security risk which should not be ignored. Once a PC has access to the internet there is risk of exposure to whatever we have stored there.

[coinlary]

What is a reputable hardware wallet? Because I knew that Ledger, Trezor, Coldcard are reputable hardware wallet providers, but none of them are free from bad incidents.

Sorry to say this, but  if you can't really  tell what reputable wallet is or identify one by now,  with your time spent on the forum, I'm  not sure I can really respond to that.

Now, even if we purchase a hardware wallet directly from provider without using a reseller or third-party supply chain, there is still a fear that the wallet may drain.   Actually, the only solution I can find here is to use a multi-signature based wallet.

That's a setup btw and not some type of wallet.

I'm not a fan of hardware wallet,  I don't use any but I also recommend them to people who feel setting up their own cold storage is a bit complicated.

The subject is all about compromised device, your concern is only based on vulnerability but yes, setting up a multi-signature or using a strong passphrase may help.

[Ucy]

It's better to use well regulated c exchange by advanced country than hardware wallet if you are dealing with amount you can't afford to lose, unless there is a way to verify the integrity of the hardware wallet, preferably opensource ones, before purchase. And the wallet maker should be held liable for hacks that are due to issues from their side.

It's much better to use opensource wallet on clean and possibly airgapped devices dedicated for Bitcoin wallets. The wallet must have extra layer of security such as muitisig.
Or you  should create multiple wallets or secretphrases offline using a dice, coin, etc and split your funds tnto a minimum of three parts and send to the wallets. When you need some fund to spend you should use one part and leave the rest longterm.

[Charles-Tim]

It's better to use well regulated c exchange by advanced country than hardware wallet if you are dealing with amount you can't afford to lose, unless there is a way to verify the integrity of the hardware wallet, preferably opensource ones, before purchase. And the wallet maker should be held liable for hacks that are due to issues from their side.

I have seen people that said exchange blocked their account because of suspicious transaction.

There was someone that is close to me that one of the exchanges blocked his account. After complaints, the exchange waste his time after providing source of funds. After several weeks, the exchange released the coin for him and his exchange account was change to withdraw-only. There could be unforeseen disappointment while using an exchange. Not your key not your coin.

Multisig or the simple singlesig passphrase cold wallet should be good if generated on a good and reputed wallet.

[bitcoin-shark]

Generally speaking, Trezor and Ledger hardware wallets are quite secure—provided they are purchased from official retailers (though nothing is 100% secure). However, given recent developments, I wouldn't fully vouch for Coldcard; the usual precautions—such as keeping your passphrase safe and separate from the wallet—should suffice.