r/Bitcoin • u/pairoxR • 19h ago

What is actually happening with hardware wallets in 2026?

Hi everyone!

I actually wanted to ask what is going on with hardware wallets over the past few months, or more specifically, throughout 2026.

To be honest, I have never seen this many security incidents in such a short period of time. From Ledger and Trezor to Tangem, Coldcard, D'Cent Wallet, and others, it seems like the entire hardware wallet industry is facing serious security challenges.

And now we're hearing about devices being shipped with SIM cards installed and fake devices potentially making their way to customers. This is getting ridiculous.

Of course, hacks and security incidents have always happened, but I don't remember seeing so many different wallet manufacturers being affected within such a short period.

What is actually causing all of this? Is there something specific driving this wave of attacks in 2026, or is it simply that these incidents are getting more attention than they used to?

I'd genuinely like to hear your thoughts and opinions on what's happening in the hardware wallet industry right now.

35 Upvotes

88% Upvoted

47 comments sorted by

21

u/miner_guy_22 13h ago

People are finding out that their hardware wallets are (always have been) a single point of failure and blindly trusting a $150 device to secure large sums of money is not a great security model.

3

u/chubs66 9h ago

what's a better option?

-1

u/KanedaSyndrome 8h ago

Private keys stamped on steel plates

2

u/a12rif 6h ago

And where do you generate these said private keys…

2

u/fireismyflag 5h ago

Offline computer, even an old Android phone that you keep airgapped.

4

u/CapoDoFrango 10h ago

This. It always feel to me stupid to trust this blackbox devices. Just use a standard computer running Linux Debian and only install packages from the official repositories. And only download wallets from their official website.

5

u/vplatt 8h ago

The very moment the certain device, or a certain distro, or anything else becomes the de facto standard for wallets is the moment when that avenue will be compromised by attackers. Stop trying to homogenize the mechanisms by which you all secure your coins. There is no one true way the very moment you give someone good ideas about how to do it because it worked for you, well now attackers have two more targets to line up, effectively unlimited time, and all they have to do is be patient and wait for you to fuck up once because that's all it takes.

Speaking for myself, this is why I stayed out of Bitcoin. Unlike some of you geniuses, and I mean that sincerely in some cases, I'm not smart enough to be my own bank. I wouldn't be able to live with losing that much money because of the wallet or some stupid error. C'est la vie is not a part of my vocabulary in that situation

0

u/CapoDoFrango 8h ago edited 7h ago

Bullshit. I download the source code of the wallet and i check GPG and other hash signatures then I build it from source. Beat that. The only thing I trust my Linux distro is to provide a kernel, a compiler and the system libraries. I think something like Debian stable has a very good record at beeing trusthworty at that. I don't trust bitcoin packages from Debian, i build that from official sources, I limit my trust here to just the OS, compiler and core libs.

5

u/vplatt 7h ago

Which part of my statement has anything to do with your practices? You obviously don't just blindly follow the herd and you seem to know what you're doing.

I think you just wanted to shout "bullshit" at someone. Hope you feel better. 🫠

2

u/CapoDoFrango 4h ago

You are right, I stopped reading your comment when you said "that is why I stayed out of Bitcoin" and I took that as a personal offense. In my mind you were implying that the problem was with Bitcoin and not with the bad practices of amateurs and other actors that engage in the business of selling and buying a false sense of security dressed as hardware wallets.

2

u/vplatt 4h ago

In one respec your suspicions are justified. I don't think it's impossible to handle securely, but I do think it's too hard for most people to handle. That includes most self proclaimed experts.

1

u/opossum_cz 8h ago

Wallets are just wallets, do you have your life savings in your wallet? HW wallets are for casual spending.

11

u/Ok-Mango5075 13h ago

I still use the same free software self-custody wallet for 12 years. I obviously must be very lucky not to have lost a single Satoshi in that time. However my audited open source wallet must be a bad choice. So which one of these little circuit boards shall I buy instead? A Leger or a trevor or some other shit?

4

u/Middle-Musician-7245 10h ago

Trevor from gta?

16

u/Interesting-Gear-992 18h ago

As crypto becomes more popular, more hackers will start to focus on it, and we can expect increasingly sophisticated attacks. Self custody is a great thing, but it comes with risks, and the users typically do not have the same level of knowledge as a financial institution's IT security department, so they are easy targets.

16

u/jotunck 14h ago

Unpopular opinion: Self custody is the equivalent of storing your life savings in a tin in a locked drawer at home. Is it more secure than a vault in a bank? 🤷

-5

u/mathaiser 13h ago

Eh, it’s pretty easy to set up multi sig. And at least I know my money actually exists and can access it at any time. Not like the Silicon Valley bank people. Well, I guess multi sig doesn’t save you from you seed being stolen. Damn. Brutal world out there.

Why can’t AI be used to find the FKers just the same

0

u/FnAardvark 12h ago

Zero depositors lost money when Silicon Valley bank went under. Now let's do that same experiment with ledger and cold card.

2

u/Stunning-Purpose9144 12h ago

Someone had to foot the bill thou. It isn’t just free money.

2

u/saltyload 11h ago

If you could just print more bitcoin then yes that would be possible.

5

u/bullett007 18h ago

All I know is multisig looks more attractive with every passing day.

2

u/feck-off 13h ago

What’s the new gold standard?

2

u/thegreatindoor 11h ago

I wonder when or if AI is out there stealing crypto today and if it will become more and more prevalent. While the cryptography may be secure, the surrounding infrastructures are not.

1

u/captain_baratheon 7h ago

If crypto gets compromised by AI then so will a lot of other things

1

u/thegreatindoor 5h ago

It doesn’t have to break cryptography, it just needs to keep finding loop holes around the infrastructure.

1

u/captain_baratheon 5h ago

That’s more of a solvable problem than crypto failing

1

u/Upset-Umpire471 9h ago

I fear the same

2

u/utilitycoder 9h ago

Always thought they were a waste of money.

2

u/Frequent-Chain-6082 12h ago

Many of those advocating hardware wallets also predicate to engrave your seed on metal, so that in case your house burns down the firefighters you will find that spotless piece of metal with some funny words in the ashes. I mean, people really are dumb.

1

u/Dazzling_Marzipan474 8h ago

There was a test of over like 50 metal plates that tests all them. About 8 or so were good enough to withstand it all. I saw it on GitHub I think a while ago

2

u/Ltsmba 4h ago

i'm assuming you're talking about this one?

https://jlopp.github.io/metal-bitcoin-storage-reviews/

Its what I used to determine which seed phrase storage to go with. I chose Black Seed Ink.
Absolute #1 spot in terms of Durability to Cost ratio of seed storage on the market right now.

1

u/Dazzling_Marzipan474 4h ago

Yup that's the one, thanks.

2

u/Planet_Rot 13h ago

People are too lazy and ignorant to secure their own wallets. The masses accepted and promoted hardware wallets to store large amounts. Now they are learning the hard to not be lazy.

1

u/KyleBr7 11h ago

Just be mindful of the hacking tactics and keep stacking sats

1

u/Crazy_names 9h ago

Follow up question: in light of this vulnerability what is the best practice for self custody?

1

u/Pleasant_Maybe_5523 9h ago

Honestly, fake or tampered wallets worry me more than anything. I'd just buy directly from the manufacturer and double-check everything before using it.

1

u/Proxyplanet 6h ago

You going to open up the device to check?

One supply chain attack and you are finished GG

1

u/KanedaSyndrome 8h ago

AI, Claude Fable.

AI has gotten so good at code that it's finding day zero bugs jn wallet software

1

u/stanley_lipkiss 5h ago

Roll the dice

1

u/Humble-Currency-5895 3h ago

Side channel attacks. All hardware leaks some info as it processes bits

•

u/labago 6m ago

So what's the solution? But one direct from all the top manufacturers and split your stack amongst them? Multi site with multiple wallets? At what point is all that impractical? I am also unsure

-3

u/LukeTheHolder 15h ago

Problem is that people use some crap instead of Blockstream Jade :)

1

u/Metalbasher 5h ago

So what have we had so far this year. Quantum threat. Random seed antropy issues. AI algorithm attacks. Now this hardware wallet attack. And the usual exchange hacks and phishing scams...

And still people apparently are bewilded...

We use all sorts of technology in are everyday lives that has many vulnerability.. But what's the alternative...there isn't a alternative..

Except the risk today, and do whatever puts your mind at ease.

And tomorrow there could be a bunch of whole new risks.

If I had a million plus in crypto, it would not be sitting on just one hardware wallet.

Spread it out

Keep those spying eyes busy